DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-08-06
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um einen Spoofing-Angriff durchzuführen, beliebigen Code auszuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
01
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-8900US | high7.5 | — | ||
An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129, Firefox… | ||||
| CVE-2024-7531US | medium6.5OT erhöht | — | ||
Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects… | ||||
| CVE-2024-7530US | high8.8 | — | ||
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129. | ||||
| CVE-2024-7529US | medium6.5 | — | ||
The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129… | ||||
| CVE-2024-7528US | high8.8 | — | ||
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1. | ||||
| CVE-2024-7527US | high8.8 | — | ||
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbir… | ||||
| CVE-2024-7526US | medium6.5 | — | ||
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefo… | ||||
| CVE-2024-7525US | high8.1OT erhöht | — | ||
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulne… | ||||
| CVE-2024-7524US | medium6.1 | — | ||
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic"… | ||||
| CVE-2024-7523US | high8.1 | — | ||
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions.
*This issue only affects Android versio… | ||||
| CVE-2024-7522US | high8.8 | — | ||
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, T… | ||||
| CVE-2024-7521US | high8.8 | — | ||
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.… | ||||
| CVE-2024-7520US | high8.8 | — | ||
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thun… | ||||
| CVE-2024-7519US | critical9.6 | — | ||
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerabili… | ||||
| CVE-2024-7518US | medium6.5 | — | ||
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Fire… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2024:5322 vom 2024-08-15external
- Red Hat Security Advisory RHSA-2024:5323 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5324 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5325 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5326 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5327 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5328 vom 2024-08-14external
- Red Hat Security Advisory RHSA-2024:5329 vom 2024-08-14external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan