Mozilla Firefox: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 16

• Critical 9.8
  CVE-2024-5695

  If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assert…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• Critical 9.8
  CVE-2024-5699

  In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• Critical 9.8
  CVE-2024-5701

  Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• High 8.6
  CVE-2024-5696

  By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potential…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• High 8.1
  CVE-2024-5688

  If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• High 7.5
  CVE-2024-5694

  An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• High 7.5
  CVE-2024-5702

  Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2024
• High 7.0
  CVE-2024-5700

  Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed eviden…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 6.5
  CVE-2024-5692

  On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Wolfi
  Jun 11, 2024
• Medium 6.1
  CVE-2024-5693

  Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another si…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 5.4
  CVE-2024-5698

  By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the a…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• Medium 5.3
  CVE-2024-5687

  If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new…

  Mozilla Firefox firefox Browsers Wolfi
  Jun 11, 2024
• Medium 5.3
  CVE-2024-5697

  A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Fir…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• Medium 4.7
  CVE-2024-5691

  By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clic…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024
• Medium 4.3
  CVE-2024-5689

  In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Jun 11, 2024
• Medium 4.3
  CVE-2024-5690

  By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were fu…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Jun 11, 2024

Revision history

1. 2024-12-15 #19

   Neue Updates von openSUSE aufgenommen

2. 2024-12-08 #18

   Neue Updates von Gentoo aufgenommen

3. 2024-11-21 #17

   Neue Updates von XEROX aufgenommen

4. 2024-09-05 #16

   Neue Updates von XEROX aufgenommen

5. 2024-08-13 #15

   Neue Updates von Amazon aufgenommen

6. 2024-08-05 #14

   Neue Updates von Gentoo aufgenommen

7. 2024-07-11 #13

   Neue Updates von SUSE und Amazon aufgenommen

8. 2024-07-10 #12

   Neue Updates von Amazon aufgenommen

9. 2024-07-09 #11

   Neue Updates von SUSE aufgenommen

10. 2024-07-02 #10

    Neue Updates von Ubuntu und Rocky Enterprise Software Foundation aufgenommen

11. 2024-06-23 #9

    Neue Updates von Red Hat aufgenommen

12. 2024-06-20 #8

    Neue Updates von Red Hat und Oracle Linux aufgenommen

13. 2024-06-19 #7

    Neue Updates von Red Hat aufgenommen

14. 2024-06-18 #6

    Neue Updates von SUSE und Ubuntu aufgenommen

15. 2024-06-17 #5

    Neue Updates von Oracle Linux und Red Hat aufgenommen

16. 2024-06-16 #4

    Neue Updates von Debian aufgenommen

17. 2024-06-13 #3

    Neue Updates von Debian aufgenommen

18. 2024-06-12 #2

    Neue Updates von SUSE und Debian aufgenommen

19. 2024-06-11 #1

    Initiale Fassung

References

• Mozilla Security Advisory MFSA 2024-25 vom 2024-06-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-25/
• Mozilla Security Advisory MFSA 2024-26 vom 2024-06-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-26/
• SUSE Security Update SUSE-SU-2024:2012-1 vom 2024-06-12
  https://lists.suse.com/pipermail/sle-security-updates/2024-June/018709.html
• Debian Security Advisory DSA-5709 vom 2024-06-12
  https://security-tracker.debian.org/tracker/DSA-5709-1
• Debian Security Advisory DLA-3825 vom 2024-06-13
  https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html
• Debian Security Advisory DSA-5711 vom 2024-06-15
  https://lists.debian.org/debian-security-announce/2024/msg00121.html
• Oracle Linux Security Advisory ELSA-2024-3951 vom 2024-06-17
  https://linux.oracle.com/errata/ELSA-2024-3951.html
• Red Hat Security Advisory RHSA-2024:3949 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3949
• Oracle Linux Security Advisory ELSA-2024-3954 vom 2024-06-18
  https://linux.oracle.com/errata/ELSA-2024-3954.html
• Oracle Linux Security Advisory ELSA-2024-3955 vom 2024-06-18
  https://linux.oracle.com/errata/ELSA-2024-3955.html
• Red Hat Security Advisory RHSA-2024:3950 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3950
• Red Hat Security Advisory RHSA-2024:3951 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3951
• Red Hat Security Advisory RHSA-2024:3952 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3952
• Red Hat Security Advisory RHSA-2024:3953 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3953
• Red Hat Security Advisory RHSA-2024:3958 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3958
• Red Hat Security Advisory RHSA-2024:3954 vom 2024-06-17
  https://access.redhat.com/errata/RHSA-2024:3954
• Red Hat Security Advisory RHSA-2024:3955 vom 2024-06-17
  https://access.redhat.com/errata/RHSA-2024:3955
• Red Hat Security Advisory RHSA-2024:3972 vom 2024-06-18
  https://access.redhat.com/errata/RHSA-2024:3972
• SUSE Security Update SUSE-SU-2024:2073-1 vom 2024-06-18
  https://lists.suse.com/pipermail/sle-security-updates/2024-June/018749.html
• SUSE Security Update SUSE-SU-2024:2061-1 vom 2024-06-18
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YCUMLO2IIP7MC3GZY2YWW6ZG2EPDBEFE/
• Ubuntu Security Notice USN-6840-1 vom 2024-06-19
  https://ubuntu.com/security/notices/USN-6840-1
• Debian Security Advisory DLA-3836 vom 2024-06-19
  https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html
• Red Hat Security Advisory RHSA-2024:4003 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4003
• Red Hat Security Advisory RHSA-2024:4002 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4002
• Red Hat Security Advisory RHSA-2024:4004 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4004
• Red Hat Security Advisory RHSA-2024:4015 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4015
• Red Hat Security Advisory RHSA-2024:4016 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4016
• Red Hat Security Advisory RHSA-2024:4018 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4018
• Red Hat Security Advisory RHSA-2024:4001 vom 2024-06-20
  https://rhn.redhat.com/errata/RHSA-2024:4001.html
• Oracle Linux Security Advisory ELSA-2024-4002 vom 2024-06-20
  https://linux.oracle.com/errata/ELSA-2024-4002.html
• Oracle Linux Security Advisory ELSA-2024-4016 vom 2024-06-20
  https://linux.oracle.com/errata/ELSA-2024-4016.html
• Red Hat Security Advisory RHSA-2024:4036 vom 2024-06-20
  https://access.redhat.com/errata/RHSA-2024:4036
• Oracle Linux Security Advisory ELSA-2024-4036 vom 2024-06-21
  https://linux.oracle.com/errata/ELSA-2024-4036.html
• Red Hat Security Advisory RHSA-2024:4063 vom 2024-06-24
  https://access.redhat.com/errata/RHSA-2024:4063
• Ubuntu Security Notice USN-6862-1 vom 2024-07-03
  https://ubuntu.com/security/notices/USN-6862-1
• Rocky Linux Security Advisory RLSA-2024:3954 vom 2024-07-02
  https://errata.build.resf.org/RLSA-2024:3954
• Rocky Linux Security Advisory RLSA-2024:3955 vom 2024-07-02
  https://errata.build.resf.org/RLSA-2024:3955
• Rocky Linux Security Advisory RLSA-2024:4002 vom 2024-07-02
  https://errata.build.resf.org/RLSA-2024:4002
• Rocky Linux Security Advisory RLSA-2024:4036 vom 2024-07-02
  https://errata.build.resf.org/RLSA-2024:4036
• SUSE Security Update SUSE-SU-2024:2371-1 vom 2024-07-09
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018902.html
• Amazon Linux Security Advisory ALASFIREFOX-2024-026 vom 2024-07-10
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-026.html
• SUSE Security Update SUSE-SU-2024:2399-1 vom 2024-07-11
  https://lists.suse.com/pipermail/sle-security-updates/2024-July/018937.html
• Amazon Linux Security Advisory ALAS-2024-2583 vom 2024-07-11
  https://alas.aws.amazon.com/AL2/ALAS-2024-2583.html
• Gentoo Linux Security Advisory GLSA-202408-02 vom 2024-08-06
  https://security.gentoo.org/glsa/202408-02
• Amazon Linux Security Advisory ALASFIREFOX-2024-027 vom 2024-08-13
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-027.html
• XEROX Security Advisory XRX24-013 vom 2024-09-05
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/09/Xerox-Security-Bulletin-XRX24-013-for-Xerox-FreeFlow-Print-Server-v2-_Windows10.pdf
• XEROX Security Advisory XRX24-017 vom 2024-11-21
  https://securitydocs.business.xerox.com/wp-content/uploads/2024/11/Xerox-Security-Bulletin-XRX24-017-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf
• Gentoo Linux Security Advisory GLSA-202412-13 vom 2024-12-08
  https://security.gentoo.org/glsa/202412-13
• Gentoo Linux Security Advisory GLSA-202412-06 vom 2024-12-07
  https://security.gentoo.org/glsa/202412-06
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/