Summary
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-11692,
CVE-2024-11694, CVE-2024-11695, CVE-2024-11696, CVE-2024-11697,
CVE-2024-11699, CVE-2024-11701, CVE-2024-11704, CVE-2024-11705,
CVE-2024-11706, CVE-2024-11708)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 133.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 11
-
Critical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…
-
Critical 9.1
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segm…
-
High 8.8
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?…
-
High 8.8
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence…
-
Medium 6.5
A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_U…
-
Medium 6.5
Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. Thi…
-
Medium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…
-
Medium 5.4
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…
-
Medium 5.4
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature ve…
-
Medium 4.3
An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possi…
-
Medium 4.3
The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could ha…
References
-
report
https://ubuntu.com/security/CVE-2024-11692
-
report
https://ubuntu.com/security/CVE-2024-11694
-
report
https://ubuntu.com/security/CVE-2024-11695
-
report
https://ubuntu.com/security/CVE-2024-11696
-
report
https://ubuntu.com/security/CVE-2024-11697
-
report
https://ubuntu.com/security/CVE-2024-11699
-
report
https://ubuntu.com/security/CVE-2024-11701
-
report
https://ubuntu.com/security/CVE-2024-11704
-
report
https://ubuntu.com/security/CVE-2024-11705
-
report
https://ubuntu.com/security/CVE-2024-11706
-
report
https://ubuntu.com/security/CVE-2024-11708