Skip to content
OpenAdvisories
High WID-SEC-2024-1568 17 CVEs

Mozilla Firefox und Firefox ESR: Mehrere Schwachstellen

Published Jul 9, 2024 · Updated Mar 16, 2025 · Revision 33 · de-DE

Vendor: amazon Vendor: Debian Vendor: gentoo Vendor: IBM Vendor: Mozilla Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Vendor: Xerox Product: App Connect Enterprise Product: Enterprise Linux Product: Firefox Product: Firefox ESR Product: FreeFlow Print Server Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Product: Thunderbird Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Firefox ESR ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmechanismen zu umgehen, Daten zu manipulieren und den Benutzer zu täuschen.

Product

Firefox ist ein Open Source Web Browser.
ESR ist die Variante mit verlängertem Support.

Vulnerabilities 17

  • Critical 9.8
    CVE-2024-6602

    Memory corruption in NSS

    A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2024-6611

    Incorrect handling of SameSite cookies

    A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • High 8.8
    CVE-2024-6605

    Firefox Android missed activation delay to prevent tapjacking

    Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.

    Mozilla Firefox firefox Browsers Wolfi
  • High 8.8
    CVE-2024-6607

    Leaving pointerlock by pressing the escape key could be prevented

    It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `&lt;select&gt;` element over certain permission prompts. This could be used to confuse a user into giving a site unintended per…

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • High 8.8
    CVE-2024-6609

    Memory corruption in NSS

    When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2024-6615

    Memory safety bugs fixed in Firefox 128 and Thunderbird 128

    Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 1…

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • High 8.2
    CVE-2024-6606

    Out-of-bounds read in clipboard component

    Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • High 7.5
    CVE-2024-6604

    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13

    Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabi…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • High 7.5
    CVE-2024-7652

    Type Confusion in Async Generators in Javascript Engine

    An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.1…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • High 7.4
    CVE-2024-6603

    Memory corruption in thread creation

    In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • Medium 6.3
    CVE-2024-6600

    Memory corruption in WebGL API

    Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on macOS. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Wolfi
  • Medium 6.3
    CVE-2024-6610

    Form validation popups could block exiting full-screen mode

    Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 5.5
    CVE-2024-6613

    Incorrect listing of stack frames

    The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 5.3
    CVE-2024-6612

    CSP violation leakage when using devtools

    CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 4.7
    CVE-2024-6601

    Race condition in permission assignment

    A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • Medium 4.3
    CVE-2024-6608

    Cursor could be moved out of the viewport using pointerlock.

    It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 4.3
    CVE-2024-6614

    Incorrect listing of stack frames

    The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi

Revision history

  1. #33

    Neue Updates von IBM aufgenommen

  2. #32

    Neue Updates von XEROX aufgenommen

  3. #31

    Neue Updates von openSUSE aufgenommen

  4. #30

    Neue Updates von Gentoo aufgenommen

  5. #29

    Neue Updates von Debian aufgenommen

  6. #28

    Neue Updates von Debian aufgenommen

  7. #27

    Neue Updates von Oracle Linux aufgenommen

  8. #26

    Neue Updates von Amazon aufgenommen

  9. #25

    Neue Updates von SUSE aufgenommen

  10. #24

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  11. #23

    Neue Updates von Oracle Linux aufgenommen

  12. #22

    Neue Updates von Red Hat aufgenommen

  13. #21

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  14. #20

    Neue Updates von Red Hat aufgenommen

  15. #19

    Neue Updates von Red Hat aufgenommen

  16. #18

    CVE ergänzt

  17. #17

    Neue Updates von XEROX aufgenommen

  18. #16

    Neue Updates von SUSE aufgenommen

  19. #15

    Neue Updates von Amazon aufgenommen

  20. #14

    Neue Updates von SUSE aufgenommen

  21. #13

    Neue Updates von SUSE aufgenommen

  22. #12

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

  23. #11

    Neue Updates von Red Hat aufgenommen

  24. #10

    Neue Updates von Red Hat aufgenommen

  25. #9

    Neue Updates von Red Hat aufgenommen

References