Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Critical 9.8
  CVE-2024-8381 Public exploit

  A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8384

  The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8385

  A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confus…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8387

  Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Critical 9.8
  CVE-2024-8389

  Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that …

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Sep 3, 2024
• High 8.8
  CVE-2024-8382

  Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for t…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• High 7.5
  CVE-2024-8383

  Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme tha…

  Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Medium 6.5
  CVE-2024-8394

  When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a …

  Mozilla Thunderbird thunderbird Debian
  Sep 6, 2024
• Medium 6.1
  CVE-2024-8386

  If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of ano…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Sep 3, 2024
• Medium 4.3
  CVE-2024-8388

  Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing t…

  Mozilla Firefox firefox Browsers Wolfi
  Sep 3, 2024
• Unscored —
  CVE-2023-6870

  Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications display…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Dec 19, 2023

Revision history

1. 2025-01-12 #18

   Neue Updates von XEROX aufgenommen

2. 2024-12-15 #17

   Neue Updates von openSUSE aufgenommen

3. 2024-12-08 #16

   Neue Updates von Gentoo aufgenommen

4. 2024-10-24 #15

   Neue Updates von Oracle Linux aufgenommen

5. 2024-10-03 #14

   Neue Updates von Amazon aufgenommen

6. 2024-10-01 #13

   Neue Updates von SUSE aufgenommen

7. 2024-09-30 #12

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

8. 2024-09-29 #11

   Neue Updates von openSUSE aufgenommen

9. 2024-09-23 #10

   Neue Updates von openSUSE aufgenommen

10. 2024-09-22 #9

    Neue Updates von Ubuntu aufgenommen

11. 2024-09-19 #8

    Neue Updates von Red Hat aufgenommen

12. 2024-09-18 #7

    Neue Updates von Amazon, Red Hat und Oracle Linux aufgenommen

13. 2024-09-17 #6

    Neue Updates von Red Hat aufgenommen

14. 2024-09-16 #5

    Neue Updates von Red Hat aufgenommen

15. 2024-09-11 #4

    CVE ergänzt

16. 2024-09-08 #3

    Neue Updates von SUSE und Mozilla aufgenommen

17. 2024-09-04 #2

    Neue Updates von Debian und Ubuntu aufgenommen

18. 2024-09-03 #1

    Initiale Fassung

References

• Mozilla Security Advisory vom 2024-09-03
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-39/
• Mozilla Security Advisory vom 2024-09-03
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-40/
• Mozilla Security Advisory vom 2024-09-03
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-41/
• Debian Security Advisory DSA-5765 vom 2024-09-04
  https://security-tracker.debian.org/tracker/DSA-5765-1
• Debian Security Advisory DLA-3869 vom 2024-09-04
  https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html
• Ubuntu Security Notice USN-6992-1 vom 2024-09-05
  https://ubuntu.com/security/notices/USN-6992-1
• SUSE Security Update SUSE-SU-2024:3152-1 vom 2024-09-06
  https://lists.suse.com/pipermail/sle-security-updates/2024-September/019386.html
• Mozilla Security Advisory MFSA2024-43 vom 2024-09-06
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-43/
• SUSE Security Update SUSE-SU-2024:3157-1 vom 2024-09-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DKFVVQWCU4OVA3BTEAU7Z5JQO5UJO4O3/
• Mozilla Security Advisory MFSA2024-44 vom 2024-09-06
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-44/
• Ubuntu Security Notice USN-6995-1 vom 2024-09-09
  https://ubuntu.com/security/notices/USN-6995-1
• Debian Security Advisory DSA-5767 vom 2024-09-08
  https://lists.debian.org/debian-security-announce/2024/msg00180.html
• Debian Security Advisory DLA-3882 vom 2024-09-09
  https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html
• Red Hat Security Advisory RHSA-2024:6681 vom 2024-09-16
  https://access.redhat.com/errata/RHSA-2024:6681
• Red Hat Security Advisory RHSA-2024:6683 vom 2024-09-16
  https://access.redhat.com/errata/RHSA-2024:6683
• Red Hat Security Advisory RHSA-2024:6684 vom 2024-09-16
  https://access.redhat.com/errata/RHSA-2024:6684
• Red Hat Security Advisory RHSA-2024:6682 vom 2024-09-16
  https://access.redhat.com/errata/RHSA-2024:6682
• Red Hat Security Advisory RHSA-2024:6721 vom 2024-09-17
  https://access.redhat.com/errata/RHSA-2024:6721
• Red Hat Security Advisory RHSA-2024:6719 vom 2024-09-17
  https://access.redhat.com/errata/RHSA-2024:6719
• Red Hat Security Advisory RHSA-2024:6720 vom 2024-09-17
  https://access.redhat.com/errata/RHSA-2024:6720
• Red Hat Security Advisory RHSA-2024:6722 vom 2024-09-17
  https://access.redhat.com/errata/RHSA-2024:6722
• Red Hat Security Advisory RHSA-2024:6723 vom 2024-09-17
  https://access.redhat.com/errata/RHSA-2024:6723
• Amazon Linux Security Advisory ALASFIREFOX-2024-029 vom 2024-09-18
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-029.html
• Red Hat Security Advisory RHSA-2024:6816 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6816
• Oracle Linux Security Advisory ELSA-2024-6681 vom 2024-09-19
  https://linux.oracle.com/errata/ELSA-2024-6681.html
• Oracle Linux Security Advisory ELSA-2024-6683 vom 2024-09-19
  https://linux.oracle.com/errata/ELSA-2024-6683.html
• Oracle Linux Security Advisory ELSA-2024-6684 vom 2024-09-19
  https://linux.oracle.com/errata/ELSA-2024-6684.html
• Oracle Linux Security Advisory ELSA-2024-6682 vom 2024-09-19
  https://linux.oracle.com/errata/ELSA-2024-6682.html
• Red Hat Security Advisory RHSA-2024:6892 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6892
• Red Hat Security Advisory RHSA-2024:6891 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6891
• Red Hat Security Advisory RHSA-2024:6838 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6838
• Ubuntu Security Notice USN-6992-2 vom 2024-09-23
  https://ubuntu.com/security/notices/USN-6992-2
• openSUSE Security Update OPENSUSE-SU-2024:14358-1 vom 2024-09-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5S76WFG23P4ITMRS7RGPVTUJR3KZSV24/
• openSUSE Security Update OPENSUSE-SU-2024:14369-1 vom 2024-09-29
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VJV2343USGKZZGZDZGLQNTRCJZRRSSKT/
• Rocky Linux Security Advisory RLSA-2024:6683 vom 2024-09-30
  https://errata.build.resf.org/RLSA-2024:6683
• Rocky Linux Security Advisory RLSA-2024:6681 vom 2024-09-30
  https://errata.build.resf.org/RLSA-2024:6681
• SUSE Security Update SUSE-SU-2024:3507-1 vom 2024-10-01
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LGSRZTILBCJ2M5GOJ5QXOW6BPA3NQ4MR/
• SUSE Security Update SUSE-SU-2024:3507-1 vom 2024-10-01
  https://lists.suse.com/pipermail/sle-security-updates/2024-October/019538.html
• SUSE Security Update SUSE-SU-2024:3507-1 vom 2024-10-01
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LGSRZTILBCJ2M5GOJ5QXOW6BPA3NQ4MR/
• Amazon Linux Security Advisory ALAS-2024-2638 vom 2024-10-02
  https://alas.aws.amazon.com/AL2/ALAS-2024-2638.html
• Oracle Linux Security Advisory ELSA-2024-6838 vom 2024-10-25
  https://linux.oracle.com/errata/ELSA-2024-6838.html
• Gentoo Linux Security Advisory GLSA-202412-04 vom 2024-12-07
  https://security.gentoo.org/glsa/202412-04
• Gentoo Linux Security Advisory GLSA-202412-06 vom 2024-12-07
  https://security.gentoo.org/glsa/202412-06
• Gentoo Linux Security Advisory GLSA-202412-13 vom 2024-12-08
  https://security.gentoo.org/glsa/202412-13
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/
• XEROX Security Advisory XRX25-001 vom 2025-01-13
  https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-001-for-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v9.pdf