NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird
view advisory published 2024-08-07
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-7531US | medium6.5OT elevated | — | ||
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects… | ||||
| CVE-2024-7530US | high8.8 | — | ||
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129. | ||||
| CVE-2024-7529US | medium6.5 | — | ||
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129… | ||||
| CVE-2024-7528US | high8.8 | — | ||
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1. | ||||
| CVE-2024-7527US | high8.8 | — | ||
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbir… | ||||
| CVE-2024-7526US | medium6.5 | — | ||
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefo… | ||||
| CVE-2024-7525US | high8.1OT elevated | — | ||
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulne… | ||||
| CVE-2024-7524US | medium6.1 | — | ||
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic"… | ||||
| CVE-2024-7523US | high8.1 | — | ||
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions.
*This issue only affects Android versio… | ||||
| CVE-2024-7522US | high8.8 | — | ||
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, T… | ||||
| CVE-2024-7521US | high8.8 | — | ||
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.… | ||||
| CVE-2024-7520US | high8.8 | — | ||
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thun… | ||||
| CVE-2024-7519US | critical9.6 | — | ||
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerabili… | ||||
| CVE-2024-7518US | medium6.5 | — | ||
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Fire… | ||||
02
references
External citations — patches, advisories, analysis.
- Source - mozillaexternal
- Source - mozillaexternal
- Source - mozillaexternal
- Source - mozillaexternal
- Source - mozillaexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan