Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* Firefox: 115.14/128.1 ESR ()
* mozilla: Fullscreen notification dialog can be obscured by document content (CVE-2024-7518)
* mozilla: Out of bounds memory access in graphics shared memory handling (CVE-2024-7519)
* mozilla: Type confusion in WebAssembly (CVE-2024-7520)
* mozilla: Incomplete WebAssembly exception handing (CVE-2024-7521)
* mozilla: Out of bounds read in editor component (CVE-2024-7522)
* mozilla: CSP strict-dynamic bypass using web-compatibility shims (CVE-2024-7524)
* mozilla: Missing permission check when creating a StreamFilter (CVE-2024-7525)
* mozilla: Uninitialized memory used by WebGL (CVE-2024-7526)
* mozilla: Use-after-free in JavaScript garbage collection (CVE-2024-7527)
* mozilla: Use-after-free in IndexedDB (CVE-2024-7528)
* mozilla: Document content could partially obscure security prompts (CVE-2024-7529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | firefox | 0:115.14.0-2.el8_10 |
Vulnerabilities 11
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
High 8.8
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged…
-
High 8.8
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulne…
-
High 8.8
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox…
-
High 8.1
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
High 7.5
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak …
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
-
Medium 6.1
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a si…