Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 16

• Critical 9.8
  CVE-2024-4764

  Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• Critical 9.8
  CVE-2024-4778

  Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• High 8.8
  CVE-2024-4770

  When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• High 8.6
  CVE-2024-4771

  A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have tr…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• High 8.2
  CVE-2024-4776

  A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• High 8.1
  CVE-2024-4765

  Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite ano…

  Mozilla Firefox Browsers
  May 14, 2024
• High 7.5
  CVE-2024-4773

  When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. Thi…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• High 7.5
  CVE-2024-4777

  Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed eviden…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 6.5
  CVE-2024-4774

  The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics fo…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• Medium 6.1
  CVE-2024-4768

  A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting pe…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 5.9
  CVE-2024-4769

  When importing resources using Web Workers, error messages would distinguish the difference between `application/javasc…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024
• Medium 5.9
  CVE-2024-4772

  An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vul…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• Medium 5.9
  CVE-2024-4775

  An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  May 14, 2024
• Medium 5.6
  CVE-2024-4367 Public exploit EPSS 71%

  PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

  A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  May 14, 2024
• Medium 4.3
  CVE-2024-4766

  Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to pot…

  Mozilla Firefox Browsers
  May 14, 2024
• Medium 4.3
  CVE-2024-4767

  If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  May 14, 2024

Revision history

1. 2025-04-22 #18

   PoC für CVE-2024-4367 aufgenommen

2. 2024-12-15 #17

   Neue Updates von openSUSE aufgenommen

3. 2024-11-21 #16

   Neue Updates von XEROX aufgenommen

4. 2024-10-15 #15

   Neue Updates aufgenommen

5. 2024-09-05 #14

   Neue Updates von XEROX aufgenommen

6. 2024-08-19 #13

   Neue Updates von SUSE aufgenommen

7. 2024-08-05 #12

   Neue Updates von Gentoo aufgenommen

8. 2024-06-17 #11

   Neue Updates von IGEL aufgenommen

9. 2024-06-16 #10

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

10. 2024-06-11 #9

    Neue Updates von Amazon und Oracle Linux aufgenommen

11. 2024-06-10 #8

    Neue Updates von Red Hat aufgenommen

12. 2024-05-28 #7

    Neue Updates von Ubuntu aufgenommen

13. 2024-05-23 #6

    Neue Updates von SUSE und Red Hat aufgenommen

14. 2024-05-21 #5

    Neue Updates von Ubuntu aufgenommen

15. 2024-05-20 #4

    Neue Updates von Oracle Linux, Red Hat, Ubuntu, Debian und SUSE aufgenommen

16. 2024-05-16 #3

    Neue Updates von Red Hat und Oracle Linux aufgenommen

17. 2024-05-15 #2

    Neue Updates von Debian aufgenommen

18. 2024-05-14 #1

    Initiale Fassung

References

• Mozilla Security Advisory vom 2024-05-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/
• Mozilla Security Advisory vom 2024-05-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/
• Mozilla Security Advisory vom 2024-05-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/
• Debian Security Advisory DSA-5691 vom 2024-05-15
  https://lists.debian.org/debian-security-announce/2024/msg00101.html
• Debian Security Advisory DLA-3815 vom 2024-05-16
  https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html
• Red Hat Security Advisory RHSA-2024:2885 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2885
• Red Hat Security Advisory RHSA-2024:2886 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2886
• Red Hat Security Advisory RHSA-2024:2884 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2884
• Red Hat Security Advisory RHSA-2024:2883 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2883
• Red Hat Security Advisory RHSA-2024:2882 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2882
• Red Hat Security Advisory RHSA-2024:2887 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2887
• Red Hat Security Advisory RHSA-2024:2888 vom 2024-05-16
  https://access.redhat.com/errata/RHSA-2024:2888
• Red Hat Security Advisory RHSA-2024:2881 vom 2024-05-17
  https://access.redhat.com/errata/RHSA-2024:2881
• Oracle Linux Security Advisory ELSA-2024-2881 vom 2024-05-17
  https://linux.oracle.com/errata/ELSA-2024-2881.html
• Oracle Linux Security Advisory ELSA-2024-2913 vom 2024-05-20
  https://linux.oracle.com/errata/ELSA-2024-2913.html
• Red Hat Security Advisory RHSA-2024:2903 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2903
• Red Hat Security Advisory RHSA-2024:2904 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2904
• Red Hat Security Advisory RHSA-2024:2905 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2905
• Ubuntu Security Notice USN-6779-1 vom 2024-05-21
  https://ubuntu.com/security/notices/USN-6779-1
• Red Hat Security Advisory RHSA-2024:2906 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2906
• Red Hat Security Advisory RHSA-2024:2912 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2912
• Debian Security Advisory DSA-5693 vom 2024-05-17
  https://lists.debian.org/debian-security-announce/2024/msg00103.html
• SUSE Security Update SUSE-SU-2024:1676-1 vom 2024-05-17
  https://lists.suse.com/pipermail/sle-security-updates/2024-May/018542.html
• Red Hat Security Advisory RHSA-2024:2913 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2913
• Oracle Linux Security Advisory ELSA-2024-2883 vom 2024-05-17
  https://linux.oracle.com/errata/ELSA-2024-2883.html
• Oracle Linux Security Advisory ELSA-2024-2888 vom 2024-05-17
  https://linux.oracle.com/errata/ELSA-2024-2888.html
• Debian Security Advisory DLA-3817 vom 2024-05-20
  https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html
• Red Hat Security Advisory RHSA-2024:2911 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2911
• Ubuntu Security Notice USN-6782-1 vom 2024-05-22
  https://ubuntu.com/security/notices/USN-6782-1
• SUSE Security Update SUSE-SU-2024:1770-1 vom 2024-05-23
  https://lists.suse.com/pipermail/sle-security-updates/2024-May/018597.html
• Red Hat Security Advisory RHSA-2024:3338 vom 2024-05-23
  https://access.redhat.com/errata/RHSA-2024:3338
• Ubuntu Security Notice USN-6779-2 vom 2024-05-29
  https://ubuntu.com/security/notices/USN-6779-2
• Red Hat Security Advisory RHSA-2024:3783 vom 2024-06-10
  https://access.redhat.com/errata/RHSA-2024:3783
• Red Hat Security Advisory RHSA-2024:3784 vom 2024-06-10
  https://access.redhat.com/errata/RHSA-2024:3784
• Amazon Linux Security Advisory ALASFIREFOX-2024-025 vom 2024-06-12
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-025.html
• Amazon Linux Security Advisory ALAS-2024-2561 vom 2024-06-12
  https://alas.aws.amazon.com/AL2/ALAS-2024-2561.html
• Oracle Linux Security Advisory ELSA-2024-3783 vom 2024-06-11
  https://linux.oracle.com/errata/ELSA-2024-3783.html
• Oracle Linux Security Advisory ELSA-2024-3784 vom 2024-06-12
  https://linux.oracle.com/errata/ELSA-2024-3784.html
• Rocky Linux Security Advisory RLSA-2024:2888 vom 2024-06-14
  https://errata.build.resf.org/RLSA-2024:2888
• IGEL Security Advisory vom 2024-06-18
  https://kb.igel.com/securitysafety/en/isn-2024-13-firefox-esr-vulnerabilities-129827214.html
• Gentoo Linux Security Advisory GLSA-202408-02 vom 2024-08-06
  https://security.gentoo.org/glsa/202408-02
• SUSE Security Update SUSE-SU-2024:1858-1 vom 2024-08-19
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GBCFBU3XCENDBK23ZXEWN7JMFBPOM76Q/
• XEROX Security Advisory XRX24-013 vom 2024-09-05
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/09/Xerox-Security-Bulletin-XRX24-013-for-Xerox-FreeFlow-Print-Server-v2-_Windows10.pdf
• Atlassian Security Bulletin vom 2024-10-15
  https://confluence.atlassian.com/pages/viewpage.action?pageId=1442910972
• XEROX Security Advisory XRX24-017 vom 2024-11-21
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/11/Xerox-Security-Bulletin-XRX24-017-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/
• Exploit DB #52273 vom 2025-04-22
  https://www.exploit-db.com/exploits/52273