Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 15

• Critical 9.8
  CVE-2024-3863

  The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows o…

  Mozilla Firefox Thunderbird Firefox ESR Browsers
  Apr 16, 2024
• High 8.8
  CVE-2024-3854

  In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• High 8.8
  CVE-2024-3856

  A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vuln…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• High 8.1
  CVE-2024-3864

  Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 16, 2024
• High 8.1
  CVE-2024-3865

  Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• High 7.8
  CVE-2024-3857

  The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garb…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• High 7.5
  CVE-2024-3852

  GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affect…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• High 7.5
  CVE-2024-3853

  A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection s…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• High 7.5
  CVE-2024-3858

  It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• Medium 6.5
  CVE-2024-3855

  In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• Medium 6.2
  CVE-2024-3860

  An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently tr…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• Medium 5.9
  CVE-2024-3859

  On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered b…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• Medium 5.3
  CVE-2024-3862

  The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Apr 16, 2024
• Medium 4.0
  CVE-2024-3861

  If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024
• Low 3.7
  CVE-2024-3302

  There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to cr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Apr 16, 2024

Revision history

1. 2024-12-15 #20

   Neue Updates von openSUSE aufgenommen

2. 2024-11-21 #19

   Neue Updates von XEROX aufgenommen

3. 2024-08-05 #18

   Neue Updates von Gentoo aufgenommen

4. 2024-07-07 #17

   Neue Updates von Gentoo aufgenommen

5. 2024-06-17 #16

   Neue Updates von IGEL aufgenommen

6. 2024-06-05 #15

   Neue Updates von CentOS aufgenommen

7. 2024-05-23 #14

   Neue Updates von SUSE aufgenommen

8. 2024-05-20 #13

   Neue Updates von SUSE aufgenommen

9. 2024-05-12 #12

   Neue Updates von Rocky Enterprise Software Foundation und Gentoo aufgenommen

10. 2024-05-06 #11

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

11. 2024-05-01 #10

    Neue Updates von Ubuntu aufgenommen

12. 2024-04-29 #9

    Neue Updates von Amazon aufgenommen

13. 2024-04-25 #8

    Neue Updates von SUSE aufgenommen

14. 2024-04-24 #7

    Neue Updates von Ubuntu aufgenommen

15. 2024-04-23 #6

    Neue Updates von Ubuntu, Fedora, Oracle Linux und Red Hat aufgenommen

16. 2024-04-22 #5

    Neue Updates von Oracle Linux aufgenommen

17. 2024-04-21 #4

    Neue Updates von Mozilla, SUSE, Oracle Linux und Debian aufgenommen

18. 2024-04-18 #3

    Neue Updates von Oracle Linux aufgenommen

19. 2024-04-17 #2

    Neue Updates von Debian aufgenommen

20. 2024-04-16 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory vom 2024-04-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-18/
• Mozilla Foundation Security Advisory vom 2024-04-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-19/
• SUSE Security Update SUSE-SU-2024:1319-1 vom 2024-04-16
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018373.html
• Debian Security Advisory DSA-5663 vom 2024-04-17
  https://lists.debian.org/debian-security-announce/2024/msg00072.html
• Red Hat Security Advisory RHSA-2024:1910 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1910
• Red Hat Security Advisory RHSA-2024:1909 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1909
• Red Hat Security Advisory RHSA-2024:1904 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1904
• Red Hat Security Advisory RHSA-2024:1905 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1905
• Red Hat Security Advisory RHSA-2024:1906 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1906
• Red Hat Security Advisory RHSA-2024:1907 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1907
• Red Hat Security Advisory RHSA-2024:1908 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1908
• Red Hat Security Advisory RHSA-2024:1911 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1911
• Red Hat Security Advisory RHSA-2024:1912 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1912
• Oracle Linux Security Advisory ELSA-2024-1910 vom 2024-04-18
  https://linux.oracle.com/errata/ELSA-2024-1910.html
• Mozilla Security Advisory MFSA2024-20 vom 2024-04-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-20/
• SUSE Security Update SUSE-SU-2024:1350-1 vom 2024-04-19
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018382.html
• Oracle Linux Security Advisory ELSA-2024-1912 vom 2024-04-20
  https://linux.oracle.com/errata/ELSA-2024-1912.html
• Oracle Linux Security Advisory ELSA-2024-1908 vom 2024-04-19
  https://linux.oracle.com/errata/ELSA-2024-1908.html
• Debian Security Advisory DLA-3790 vom 2024-04-19
  https://lists.debian.org/debian-lts-announce/2024/04/msg00012.html
• Red Hat Security Advisory RHSA-2024:1941 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1941
• Red Hat Security Advisory RHSA-2024:1937 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1937
• Red Hat Security Advisory RHSA-2024:1934 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1934
• Red Hat Security Advisory RHSA-2024:1940 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1940
• Red Hat Security Advisory RHSA-2024:1939 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1939
• Debian Security Advisory DLA-3791 vom 2024-04-22
  https://lists.debian.org/debian-lts-announce/2024/04/msg00013.html
• Red Hat Security Advisory RHSA-2024:1935 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1935
• Red Hat Security Advisory RHSA-2024:1936 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1936
• Debian Security Advisory DSA-5670 vom 2024-04-22
  https://lists.debian.org/debian-security-announce/2024/msg00079.html
• Oracle Linux Security Advisory ELSA-2024-1939 vom 2024-04-22
  https://linux.oracle.com/errata/ELSA-2024-1939.html
• Oracle Linux Security Advisory ELSA-2024-1935 vom 2024-04-22
  https://linux.oracle.com/errata/ELSA-2024-1935.html
• Ubuntu Security Notice USN-6747-1 vom 2024-04-24
  https://ubuntu.com/security/notices/USN-6747-1
• Fedora Security Advisory FEDORA-2024-81C9A3FE50 vom 2024-04-23
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-81c9a3fe50
• Oracle Linux Security Advisory ELSA-2024-1940 vom 2024-04-23
  https://linux.oracle.com/errata/ELSA-2024-1940.html
• Red Hat Security Advisory RHSA-2024:1982 vom 2024-04-23
  https://access.redhat.com/errata/RHSA-2024:1982
• Fedora Security Advisory FEDORA-2024-15B892EBD3 vom 2024-04-23
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-15b892ebd3
• Ubuntu Security Notice USN-6750-1 vom 2024-04-25
  https://ubuntu.com/security/notices/USN-6750-1
• SUSE Security Update SUSE-SU-2024:1437-1 vom 2024-04-25
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018423.html
• Amazon Linux Security Advisory ALASFIREFOX-2024-024 vom 2024-04-29
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-024.html
• Ubuntu Security Notice USN-6747-2 vom 2024-05-02
  https://ubuntu.com/security/notices/USN-6747-2
• Rocky Linux Security Advisory RLSA-2024:1939 vom 2024-05-06
  https://errata.build.resf.org/RLSA-2024:1939
• Rocky Linux Security Advisory RLSA-2024:1912 vom 2024-05-06
  https://errata.build.resf.org/RLSA-2024:1912
• Rocky Linux Security Advisory RLSA-2024:1940 vom 2024-05-10
  https://errata.build.resf.org/RLSA-2024:1940
• Gentoo Linux Security Advisory GLSA-202405-32 vom 2024-05-12
  https://security.gentoo.org/glsa/202405-32
• Rocky Linux Security Advisory RLSA-2024:1908 vom 2024-05-10
  https://errata.build.resf.org/RLSA-2024:1908
• SUSE Security Update SUSE-SU-2024:1676-1 vom 2024-05-17
  https://lists.suse.com/pipermail/sle-security-updates/2024-May/018542.html
• SUSE Security Update SUSE-SU-2024:1770-1 vom 2024-05-23
  https://lists.suse.com/pipermail/sle-security-updates/2024-May/018597.html
• CentOS Security Advisory CESA-2024:1910 vom 2024-06-06
  https://lwn.net/Articles/973018
• CentOS Security Advisory CESA-2024:1935 vom 2024-06-06
  https://lwn.net/Articles/973022
• IGEL Security Advisory vom 2024-06-18
  https://kb.igel.com/securitysafety/en/isn-2024-13-firefox-esr-vulnerabilities-129827214.html
• Gentoo Linux Security Advisory GLSA-202407-19 vom 2024-07-06
  https://security.gentoo.org/glsa/202407-19
• Gentoo Linux Security Advisory GLSA-202408-02 vom 2024-08-06
  https://security.gentoo.org/glsa/202408-02
• XEROX Security Advisory XRX24-017 vom 2024-11-21
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/11/Xerox-Security-Bulletin-XRX24-017-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/