Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 19

• Critical 9.8
  CVE-2024-11693

  The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Alpine Wolfi
  Nov 26, 2024
• Critical 9.8
  CVE-2024-11698

  A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen m…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Wolfi
  Nov 26, 2024
• Critical 9.8
  CVE-2024-11704

  A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Nov 26, 2024
• Critical 9.1
  CVE-2024-11705

  `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segm…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 26, 2024
• High 8.8
  CVE-2024-11691

  Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corrupt…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Ubuntu Alpine Wolfi
  Nov 26, 2024
• High 8.8
  CVE-2024-11697

  When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• High 8.8
  CVE-2024-11699

  Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• High 8.1
  CVE-2024-11700

  Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to us…

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 26, 2024
• High 7.5
  CVE-2024-11702

  Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored d…

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 26, 2024
• Medium 6.5
  CVE-2024-11706

  A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_U…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 26, 2024
• Medium 6.5
  CVE-2024-11708

  Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. Thi…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 26, 2024
• Medium 6.1
  CVE-2024-11694

  Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.7
  CVE-2024-11703

  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authenticati…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-11695

  A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-11696

  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature ve…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-53975

  Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar t…

  Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  Nov 26, 2024
• Medium 5.4
  CVE-2024-53976

  Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, mak…

  Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  Nov 26, 2024
• Medium 4.3
  CVE-2024-11692

  An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
  Nov 26, 2024
• Medium 4.3
  CVE-2024-11701

  The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could ha…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 26, 2024

Revision history

1. 2026-05-31 #25

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-05-19 #24

   Neue Updates von Red Hat aufgenommen

3. 2025-09-17 #23

   Neue Updates von Gentoo aufgenommen

4. 2025-06-02 #22

   Neue Updates von XEROX aufgenommen

5. 2025-05-11 #21

   Neue Updates von Gentoo aufgenommen

6. 2025-02-09 #20

   Neue Updates von Debian aufgenommen

7. 2025-02-06 #19

   Neue Updates von openSUSE und SUSE aufgenommen

8. 2025-02-05 #18

   Neue Updates von Debian aufgenommen

9. 2025-01-22 #17

   Neue Updates von Gentoo aufgenommen

10. 2025-01-08 #16

    Neue Updates von Ubuntu aufgenommen

11. 2024-12-19 #15

    Neue Updates von Amazon aufgenommen

12. 2024-12-18 #14

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

13. 2024-12-17 #13

    Neue Updates von openSUSE aufgenommen

14. 2024-12-16 #12

    Neue Updates von Oracle Linux aufgenommen

15. 2024-12-15 #11

    Neue Updates von Mozilla und openSUSE aufgenommen

16. 2024-12-09 #10

    Neue Updates von Fedora aufgenommen

17. 2024-12-08 #9

    Neue Updates von Red Hat aufgenommen

18. 2024-12-05 #8

    Neue Updates von Red Hat und openSUSE aufgenommen

19. 2024-12-04 #7

    Neue Updates von Oracle Linux aufgenommen

20. 2024-12-03 #6

    Neue Updates von Oracle Linux, Red Hat und SUSE aufgenommen

21. 2024-12-02 #5

    Neue Updates von Ubuntu und Red Hat aufgenommen

22. 2024-12-01 #4

    Neue Updates von Red Hat aufgenommen

23. 2024-11-28 #3

    Neue Updates von Debian aufgenommen

24. 2024-11-27 #2

    Neue Updates von Debian und SUSE aufgenommen

25. 2024-11-26 #1

    Initiale Fassung

References

• Red Hat Security Advisory RHSA-2024:10880 vom 2024-12-09
  https://access.redhat.com/errata/RHSA-2024:10880
• Red Hat Security Advisory RHSA-2024:10881 vom 2024-12-09
  https://access.redhat.com/errata/RHSA-2024:10881
• Fedora Security Advisory FEDORA-2024-FF0115E6AC vom 2024-12-09
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-ff0115e6ac
• Fedora Security Advisory FEDORA-2024-7F67755963 vom 2024-12-09
  https://bodhi.fedoraproject.org/updates/FEDORA-2024-7f67755963
• Mozilla Security Advisory MFSA2024-70 vom 2024-12-13
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-70/
• openSUSE Security Update OPENSUSE-SU-2024:14572-1 vom 2024-12-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V/
• Rocky Linux Security Advisory RLSA-2024:10591 vom 2024-12-19
  https://errata.build.resf.org/RLSA-2024:10591
• Ubuntu Security Notice USN-7193-1 vom 2025-01-09
  https://ubuntu.com/security/notices/USN-7193-1
• Oracle Linux Security Advisory ELSA-2024-10881 vom 2024-12-17
  https://linux.oracle.com/errata/ELSA-2024-10881.html
• Amazon Linux Security Advisory ALASFIREFOX-2024-033 vom 2024-12-19
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2024-033.html
• openSUSE Security Update OPENSUSE-SU-2024:14583-1 vom 2024-12-17
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/E36UEIBGR7762V7PR7XV5YQMCH76YVFN/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-63/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-64/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-65/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-66/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-67/
• Mozilla Foundation Security Advisories vom 2024-11-26
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-68/
• Debian Security Advisory DSA-5820 vom 2024-11-27
  https://lists.debian.org/debian-security-announce/2024/msg00235.html
• SUSE Security Update SUSE-SU-2024:4074-1 vom 2024-11-27
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019849.html
• Debian Security Advisory DSA-5821 vom 2024-11-27
  https://lists.debian.org/debian-security-announce/2024/msg00236.html
• SUSE Security Update SUSE-SU-2024:4086-1 vom 2024-11-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/A4674K2BTSTWJICHGZJ5CPXK5C5U65NR/
• Debian Security Advisory DLA-3971 vom 2024-11-28
  https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html
• Debian Security Advisory DLA-3969 vom 2024-11-28
  https://lists.debian.org/debian-lts-announce/2024/11/msg00027.html
• Red Hat Security Advisory RHSA-2024:10591 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10591
• Red Hat Security Advisory RHSA-2024:10592 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10592
• Red Hat Security Advisory RHSA-2024:10667 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10667
• Ubuntu Security Notice USN-7134-1 vom 2024-12-03
  https://ubuntu.com/security/notices/USN-7134-1
• Red Hat Security Advisory RHSA-2024:10704 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10704
• Red Hat Security Advisory RHSA-2024:10702 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10702
• Red Hat Security Advisory RHSA-2024:10710 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10710
• Red Hat Security Advisory RHSA-2024:10703 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:10703
• Red Hat Security Advisory RHSA-2024:10733 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10733
• Red Hat Security Advisory RHSA-2024:10734 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10734
• Red Hat Security Advisory RHSA-2024:10742 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10742
• Red Hat Security Advisory RHSA-2024:10743 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10743
• Red Hat Security Advisory RHSA-2024:10745 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10745
• Oracle Linux Security Advisory ELSA-2024-10702 vom 2024-12-03
  https://linux.oracle.com/errata/ELSA-2024-10702.html
• Red Hat Security Advisory RHSA-2024:10748 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10748
• SUSE Security Update SUSE-SU-2024:4148-1 vom 2024-12-03
  https://lists.suse.com/pipermail/sle-security-updates/2024-December/019900.html
• Red Hat Security Advisory RHSA-2024:10752 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10752
• Oracle Linux Security Advisory ELSA-2024-10592 vom 2024-12-03
  https://linux.oracle.com/errata/ELSA-2024-10592.html
• Oracle Linux Security Advisory ELSA-2024-10752 vom 2024-12-04
  https://linux.oracle.com/errata/ELSA-2024-10752.html
• Oracle Linux Security Advisory ELSA-2024-10591 vom 2024-12-04
  https://linux.oracle.com/errata/ELSA-2024-10591.html
• Red Hat Security Advisory RHSA-2024:10844 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10844
• Red Hat Security Advisory RHSA-2024:10848 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10848
• Red Hat Security Advisory RHSA-2024:10849 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10849
• openSUSE Security Update OPENSUSE-SU-2024:14542-1 vom 2024-12-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HIP7LBABDEHTEPO7WYQ5CHI542PJGK5L/
• Gentoo Linux Security Advisory GLSA-202501-10 vom 2025-01-23
  https://security.gentoo.org/glsa/202501-10
• Debian Security Advisory DSA-5858 vom 2025-02-05
  https://lists.debian.org/debian-security-announce/2025/msg00020.html
• openSUSE Security Update OPENSUSE-SU-2025:14731-1 vom 2025-02-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MP4SZWYCKRN2DG7QYUK64Y4TXD7ABUH5/
• SUSE Security Update SUSE-SU-2025:0374-1 vom 2025-02-06
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020274.html
• Debian Security Advisory DSA-5860 vom 2025-02-07
  https://lists.debian.org/debian-security-announce/2025/msg00022.html
• Debian Security Advisory DLA-4045 vom 2025-02-07
  https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
• Debian Security Advisory DLA-4044 vom 2025-02-07
  https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
• SUSE Security Update SUSE-SU-2025:0391-1 vom 2025-02-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020295.html
• Gentoo Linux Security Advisory GLSA-202505-03 vom 2025-05-12
  https://security.gentoo.org/glsa/202505-03
• XEROX Security Advisory XRX25-012 vom 2025-06-02
  https://security.business.xerox.com/wp-content/uploads/2025/06/Xerox-Security-Bulletin-XRX25-012-for-Xerox-FreeFlow-Print-Server-v9.pdf
• Gentoo Linux Security Advisory GLSA-202509-02 vom 2025-09-18
  https://security.gentoo.org/glsa/202509-02
• Red Hat Security Advisory RHSA-2026:18479 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:18479
• Rocky Linux Security Advisory RLSA-2026:18479 vom 2026-05-29
  https://errata.build.resf.org/RLSA-2026:18479