NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird
view advisory published 2024-10-30
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-10468US | medium5.3 | — | ||
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 1… | ||||
| CVE-2024-10467US | high8.8 | — | ||
Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort… | ||||
| CVE-2024-10466US | high7.5 | — | ||
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 13… | ||||
| CVE-2024-10465US | medium6.5 | — | ||
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunde… | ||||
| CVE-2024-10464US | medium6.5 | — | ||
Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this… | ||||
| CVE-2024-10463US | medium6.5 | — | ||
Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, an… | ||||
| CVE-2024-10462US | medium6.5 | — | ||
Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderb… | ||||
| CVE-2024-10461US | medium6.1 | — | ||
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This… | ||||
| CVE-2024-10460US | medium5.3 | — | ||
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thun… | ||||
| CVE-2024-10459US | high7.5 | — | ||
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 1… | ||||
| CVE-2024-10458US | high7.5 | — | ||
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Fire… | ||||
02
references
External citations — patches, advisories, analysis.
- Reference - hkcertexternal
- Reference - hkcertexternal
- Reference - hkcertexternal
- Reference - hkcertexternal
- Reference - hkcertexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan