Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 115.10.0 ESR.
Security Fix(es):
* GetBoundName in the JIT returned the wrong object (CVE-2024-3852)
* Out-of-bounds-read after mis-optimized switch statement (CVE-2024-3854)
* Incorrect JITting of arguments led to use-after-free during garbage collection (CVE-2024-3857)
* Permission prompt input delay could expire when not in focus (CVE-2024-2609)
* Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (CVE-2024-3859)
* Potential use-after-free due to AlignedBuffer self-move (CVE-2024-3861)
* Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 (CVE-2024-3864)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | firefox | 0:115.10.0-1.el9_3 |
Vulnerabilities 7
-
High 8.8
In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…
-
High 8.1
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …
-
High 7.8
The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…
-
High 7.5
GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…
-
Medium 6.1
The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacki…
-
Medium 5.9
On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…
-
Medium 4.0
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275547
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275549
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275550
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275551
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275552
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275553
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275555