Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-5689,
CVE-2024-5690, CVE-2024-5691, CVE-2024-5693, CVE-2024-5697, CVE-2024-5698,
CVE-2024-5699, CVE-2024-5700, CVE-2024-5701)
Lukas Bernhard discovered that Firefox did not properly manage memory
during garbage collection. An attacker could potentially exploit this
issue to cause a denial of service, or execute arbitrary code.
(CVE-2024-5688)
Lukas Bernhard discovered that Firefox did not properly manage memory in
the JavaScript engine. An attacker could potentially exploit this issue to
obtain sensitive information. (CVE-2024-5694)
Irvan Kurniawan discovered that Firefox did not properly handle certain
allocations in the probabilistic heap checker. An attacker could
potentially exploit this issue to cause a denial of service.
(CVE-2024-5695)
Irvan Kurniawan discovered that Firefox did not properly handle certain
text fragments in input tags. An attacker could potentially exploit this
issue to cause a denial of service. (CVE-2024-5696)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 127.0.2+build1-0ubuntu0.20.04.1 |
Vulnerabilities 13
-
Critical 9.8
If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assert…
-
Critical 9.8
In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…
-
Critical 9.8
Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.6
By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potential…
-
High 8.1
If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.…
-
High 7.5
An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section…
-
High 7.0
Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed eviden…
-
Medium 6.1
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another si…
-
Medium 5.4
By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the a…
-
Medium 5.3
A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Fir…
-
Medium 4.7
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clic…
-
Medium 4.3
In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button…
-
Medium 4.3
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were fu…
References
-
report
https://ubuntu.com/security/CVE-2024-5688
-
report
https://ubuntu.com/security/CVE-2024-5689
-
report
https://ubuntu.com/security/CVE-2024-5690
-
report
https://ubuntu.com/security/CVE-2024-5691
-
report
https://ubuntu.com/security/CVE-2024-5693
-
report
https://ubuntu.com/security/CVE-2024-5694
-
report
https://ubuntu.com/security/CVE-2024-5695
-
report
https://ubuntu.com/security/CVE-2024-5696
-
report
https://ubuntu.com/security/CVE-2024-5697
-
report
https://ubuntu.com/security/CVE-2024-5698
-
report
https://ubuntu.com/security/CVE-2024-5699
-
report
https://ubuntu.com/security/CVE-2024-5700
-
report
https://ubuntu.com/security/CVE-2024-5701