Vulnerability-Lookup

CVE-2024-9680 (GCVE-0-2024-9680)

Vulnerability from cvelistv5 – Published: 2024-10-09 12:59 – Updated: 2025-11-03 22:33

CISA KEV

Summary

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Use-after-free in Animation timeline

Assigner

mozilla

References

4 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
https://msrc.microsoft.com/update-guide/en-US/vul…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

6 products

Vendor	Product	Version
Mozilla	Firefox	Affected: unspecified , < 131.0.2 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 128.3.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 115.16.1 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 131.0.1 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 128.3.1 (custom)
Mozilla	Thunderbird	Affected: unspecified , < 115.16.0 (custom)

Credits

Damien Schaeffer from ESET

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: fb309fb7-793a-4ef2-82c1-7d90e3278c31

Vulnerability ID: CVE-2024-9680

Status: Confirmed

Status Updated: 2024-10-15 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2024-10-15

Asserted: 2024-10-15

Scope

Notes: KEV entry: Mozilla Firefox Use-After-Free Vulnerability | Affected: Mozilla / Firefox | Description: Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-11-05 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-416
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Firefox
Due Date	2024-11-05
Date Added	2024-10-15
Vendorproject	Mozilla
Vulnerabilityname	Mozilla Firefox Use-After-Free Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2024-9680

Created: 2026-02-02 12:26 UTC | Updated: 2026-02-06 07:17 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131.0.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.16.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "firefox_esr",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "128.3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.16.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "128.3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.16.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "128.3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.16.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thunderbird",
            "vendor": "mozilla",
            "versions": [
              {
                "lessThan": "131.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "128.3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "115.16.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-9680",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T12:58:45.687179Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-10-15",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:42.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-10-15T00:00:00.000Z",
            "value": "CVE-2024-9680 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:32.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "131.0.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.3.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.16.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "131.0.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "128.3.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "115.16.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Damien Schaeffer from ESET"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0."
            }
          ],
          "value": "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free in Animation timeline",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-18T18:21:58.377Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1923344"
        },
        {
          "name": "Windows sandbox escape detected with the in-the-wild exploit",
          "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-51/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2024-52/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2024-9680",
    "datePublished": "2024-10-09T12:59:07.108Z",
    "dateReserved": "2024-10-09T06:28:21.295Z",
    "dateUpdated": "2025-11-03T22:33:32.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-9680",
      "cwes": "[\"CWE-416\"]",
      "dateAdded": "2024-10-15",
      "dueDate": "2024-11-05",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680",
      "product": "Firefox",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.",
      "vendorProject": "Mozilla",
      "vulnerabilityName": "Mozilla Firefox Use-After-Free Vulnerability"
    },
    "epss": {
      "cve": "CVE-2024-9680",
      "date": "2026-05-20",
      "epss": "0.34972",
      "percentile": "0.97089"
    },
    "fkie_nvd": {
      "cisaActionDue": "2024-11-05",
      "cisaExploitAdd": "2024-10-15",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "Mozilla Firefox Use-After-Free Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\", \"versionEndExcluding\": \"115.16.1\", \"matchCriteriaId\": \"45244B45-832B-4C4A-8004-8D13C331E52B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\", \"versionEndExcluding\": \"131.0.2\", \"matchCriteriaId\": \"07E39FE8-1685-46D2-9E3E-2613F3852132\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\", \"versionStartIncluding\": \"128.1.0\", \"versionEndExcluding\": \"128.3.1\", \"matchCriteriaId\": \"C4AEB9BD-EB47-4F96-BC72-949023ACE8ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"115.16.0\", \"matchCriteriaId\": \"DB9A49A0-8233-46B2-894A-FAD4DC6ED563\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"128.0.1\", \"versionEndExcluding\": \"128.3.1\", \"matchCriteriaId\": \"F48D7DE7-477D-4026-B6BD-BFE2BC5382F3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD5E6249-26BF-4E13-87D8-B15EF63A859F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\"}, {\"lang\": \"es\", \"value\": \"Un atacante pudo ejecutar c\\u00f3digo en el proceso de contenido aprovechando un use-after-free en las l\\u00edneas de tiempo de animaci\\u00f3n. Hemos recibido informes de que esta vulnerabilidad se ha explotado de forma activa. Esta vulnerabilidad afecta a Firefox \u0026lt; 131.0.2, Firefox ESR \u0026lt; 128.3.1 y Firefox ESR \u0026lt; 115.16.1.\"}]",
      "id": "CVE-2024-9680",
      "lastModified": "2024-11-26T19:53:56.537",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-10-09T13:15:12.090",
      "references": "[{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\", \"source\": \"security@mozilla.org\", \"tags\": [\"Issue Tracking\", \"Permissions Required\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\", \"source\": \"security@mozilla.org\", \"tags\": [\"Not Applicable\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-51/\", \"source\": \"security@mozilla.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-52/\", \"source\": \"security@mozilla.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
      "sourceIdentifier": "security@mozilla.org",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-9680\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2024-10-09T13:15:12.090\",\"lastModified\":\"2025-11-04T14:35:50.977\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\"},{\"lang\":\"es\",\"value\":\"Un atacante pudo ejecutar c\u00f3digo en el proceso de contenido aprovechando un use-after-free en las l\u00edneas de tiempo de animaci\u00f3n. Hemos recibido informes de que esta vulnerabilidad se ha explotado de forma activa. Esta vulnerabilidad afecta a Firefox \u0026lt; 131.0.2, Firefox ESR \u0026lt; 128.3.1 y Firefox ESR \u0026lt; 115.16.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2024-10-15\",\"cisaActionDue\":\"2024-11-05\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Mozilla Firefox Use-After-Free Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\",\"versionEndExcluding\":\"115.16.1\",\"matchCriteriaId\":\"45244B45-832B-4C4A-8004-8D13C331E52B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*\",\"versionEndExcluding\":\"131.0.2\",\"matchCriteriaId\":\"07E39FE8-1685-46D2-9E3E-2613F3852132\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*\",\"versionStartIncluding\":\"128.1.0\",\"versionEndExcluding\":\"128.3.1\",\"matchCriteriaId\":\"C4AEB9BD-EB47-4F96-BC72-949023ACE8ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"115.16.0\",\"matchCriteriaId\":\"DB9A49A0-8233-46B2-894A-FAD4DC6ED563\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"128.0.1\",\"versionEndExcluding\":\"128.3.1\",\"matchCriteriaId\":\"F48D7DE7-477D-4026-B6BD-BFE2BC5382F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:131.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD5E6249-26BF-4E13-87D8-B15EF63A859F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\",\"source\":\"security@mozilla.org\",\"tags\":[\"Issue Tracking\",\"Permissions Required\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\",\"source\":\"security@mozilla.org\",\"tags\":[\"Not Applicable\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2024-51/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2024-52/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:33:32.973Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-9680\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-16T12:58:45.687179Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2024-10-15\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox_esr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"firefox_esr\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\"], \"vendor\": \"mozilla\", \"product\": \"thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-10-15T00:00:00.000Z\", \"value\": \"CVE-2024-9680 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-09T15:33:12.930Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"value\": \"Damien Schaeffer from ESET\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Firefox\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"131.0.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Firefox ESR\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Firefox ESR\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.16.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"131.0.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"128.3.1\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"115.16.0\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1923344\"}, {\"url\": \"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039\", \"name\": \"Windows sandbox escape detected with the in-the-wild exploit\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-51/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2024-52/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox \u003c 131.0.2, Firefox ESR \u003c 128.3.1, Firefox ESR \u003c 115.16.1, Thunderbird \u003c 131.0.1, Thunderbird \u003c 128.3.1, and Thunderbird \u003c 115.16.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Use-after-free in Animation timeline\"}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2024-11-18T18:21:58.377Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-9680\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:33:32.973Z\", \"dateReserved\": \"2024-10-09T06:28:21.295Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2024-10-09T12:59:07.108Z\", \"assignerShortName\": \"mozilla\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2024-AVI-0865

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Mozilla Firefox. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Mozilla indique que la vulnérabilité CVE-2024-9680 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Firefox	Firefox versions antérieures à 131.0.2
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 115.16.1
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 128.3.1

References

Title

Publication Time

Tags

Bulletin de sécurité Mozilla mfsa2024-51

2024-10-09

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Firefox versions ant\u00e9rieures \u00e0 131.0.2",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.16.1",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 128.3.1",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-9680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9680"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0865",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Mozilla Firefox. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nMozilla indique que la vuln\u00e9rabilit\u00e9 CVE-2024-9680 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2024-51",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/"
    }
  ]
}

CERTFR-2024-AVI-0869

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Mozilla Thunderbird. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Mozilla indique que la vulnérabilité CVE-2024-9680 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Thunderbird	Thunderbird versions antérieures à 128.3.1
Mozilla	Thunderbird	Thunderbird versions antérieures à 115.16.0
Mozilla	Thunderbird	Thunderbird versions antérieures à 131.0.1

References

Title

Publication Time

Tags

Bulletin de sécurité Mozilla mfsa2024-52

2024-10-10

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 128.3.1",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 115.16.0",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 131.0.1",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-9680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9680"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0869",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Mozilla Thunderbird. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nMozilla indique que la vuln\u00e9rabilit\u00e9 CVE-2024-9680 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Mozilla Thunderbird",
  "vendor_advisories": [
    {
      "published_at": "2024-10-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2024-52",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-52/"
    }
  ]
}

CERTFR-2024-AVI-0865

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Mozilla Firefox. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Mozilla indique que la vulnérabilité CVE-2024-9680 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Firefox	Firefox versions antérieures à 131.0.2
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 115.16.1
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 128.3.1

References

Title

Publication Time

Tags

Bulletin de sécurité Mozilla mfsa2024-51

2024-10-09

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Firefox versions ant\u00e9rieures \u00e0 131.0.2",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.16.1",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Firefox ESR versions ant\u00e9rieures \u00e0 128.3.1",
      "product": {
        "name": "Firefox ESR",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-9680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9680"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0865",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Mozilla Firefox. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nMozilla indique que la vuln\u00e9rabilit\u00e9 CVE-2024-9680 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2024-51",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/"
    }
  ]
}

CERTFR-2024-AVI-0869

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Mozilla Thunderbird. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Mozilla indique que la vulnérabilité CVE-2024-9680 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Thunderbird	Thunderbird versions antérieures à 128.3.1
Mozilla	Thunderbird	Thunderbird versions antérieures à 115.16.0
Mozilla	Thunderbird	Thunderbird versions antérieures à 131.0.1

References

Title

Publication Time

Tags

Bulletin de sécurité Mozilla mfsa2024-52

2024-10-10

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 128.3.1",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 115.16.0",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    },
    {
      "description": "Thunderbird versions ant\u00e9rieures \u00e0 131.0.1",
      "product": {
        "name": "Thunderbird",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-9680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9680"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0869",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Mozilla Thunderbird. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nMozilla indique que la vuln\u00e9rabilit\u00e9 CVE-2024-9680 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Mozilla Thunderbird",
  "vendor_advisories": [
    {
      "published_at": "2024-10-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2024-52",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2024-52/"
    }
  ]
}

alsa-2024:7958

Vulnerability from osv_almalinux

Published

2024-10-10 00:00

Modified

2024-10-12 13:30

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:7958	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://errata.almalinux.org/9/ALSA-2024-7958.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.1-2.el9_4.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox-x11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.1-2.el9_4.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2024:7958",
  "modified": "2024-10-12T13:30:02Z",
  "published": "2024-10-10T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:7958"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2024-7958.html"
    }
  ],
  "related": [
    "CVE-2024-9680"
  ],
  "summary": "Important: firefox security update"
}

alsa-2024:7977

Vulnerability from osv_almalinux

Published

2024-10-10 00:00

Modified

2024-10-12 13:31

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:7977	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://errata.almalinux.org/8/ALSA-2024-7977.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.1-2.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2024:7977",
  "modified": "2024-10-12T13:31:27Z",
  "published": "2024-10-10T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:7977"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2024-7977.html"
    }
  ],
  "related": [
    "CVE-2024-9680"
  ],
  "summary": "Important: firefox security update"
}

alsa-2024:8024

Vulnerability from osv_almalinux

Published

2024-10-14 00:00

Modified

2024-10-15 09:19

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:8024	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://errata.almalinux.org/8/ALSA-2024-8024.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.1-1.el8_10.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2024:8024",
  "modified": "2024-10-15T09:19:16Z",
  "published": "2024-10-14T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:8024"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2024-8024.html"
    }
  ],
  "related": [
    "CVE-2024-9680"
  ],
  "summary": "Important: thunderbird security update"
}

alsa-2024:8025

Vulnerability from osv_almalinux

Published

2024-10-14 00:00

Modified

2024-10-15 09:17

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:8025	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://errata.almalinux.org/9/ALSA-2024-8025.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.3.1-1.el9_4.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "ALSA-2024:8025",
  "modified": "2024-10-15T09:17:52Z",
  "published": "2024-10-14T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:8025"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2024-8025.html"
    }
  ],
  "related": [
    "CVE-2024-9680"
  ],
  "summary": "Important: thunderbird security update"
}

alsa-2024:9552

Vulnerability from osv_almalinux

Published

2024-11-13 00:00

Modified

2024-11-18 18:10

Summary

Important: thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)
firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)
firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:9552	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-10458	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10459	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10460	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10461	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10462	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10463	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10464	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10465	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10466	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10467	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://bugzilla.redhat.com/2322424	REPORT
	https://bugzilla.redhat.com/2322425	REPORT
	https://bugzilla.redhat.com/2322428	REPORT
	https://bugzilla.redhat.com/2322429	REPORT
	https://bugzilla.redhat.com/2322433	REPORT
	https://bugzilla.redhat.com/2322434	REPORT
	https://bugzilla.redhat.com/2322438	REPORT
	https://bugzilla.redhat.com/2322439	REPORT
	https://bugzilla.redhat.com/2322440	REPORT
	https://bugzilla.redhat.com/2322444	REPORT
	https://errata.almalinux.org/9/ALSA-2024-9552.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.4.0-1.el9_5.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n  * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)\n  * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)\n  * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)\n  * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)\n  * firefox: thunderbird: Clipboard \"paste\" button persisted across tabs (CVE-2024-10465)\n  * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)\n  * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)\n  * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)\n  * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2024:9552",
  "modified": "2024-11-18T18:10:34Z",
  "published": "2024-11-13T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:9552"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10458"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10459"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10460"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10461"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10462"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10463"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10464"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10465"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10466"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10467"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322424"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322425"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322428"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322429"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322433"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322439"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322444"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2024-9552.html"
    }
  ],
  "related": [
    "CVE-2024-9680",
    "CVE-2024-10464",
    "CVE-2024-10461",
    "CVE-2024-10458",
    "CVE-2024-10459",
    "CVE-2024-10467",
    "CVE-2024-10465",
    "CVE-2024-10466",
    "CVE-2024-10463",
    "CVE-2024-10462",
    "CVE-2024-10460"
  ],
  "summary": "Important: thunderbird security update"
}

alsa-2024:9554

Vulnerability from osv_almalinux

Published

2024-11-13 00:00

Modified

2024-11-18 18:09

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)
firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)
firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)
firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)
firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)
firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)
firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465)
firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)
firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)
firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)
firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2024:9554	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-10458	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10459	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10460	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10461	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10462	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10463	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10464	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10465	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10466	REPORT
	https://access.redhat.com/security/cve/CVE-2024-10467	REPORT
	https://access.redhat.com/security/cve/CVE-2024-9680	REPORT
	https://bugzilla.redhat.com/2317442	REPORT
	https://bugzilla.redhat.com/2322424	REPORT
	https://bugzilla.redhat.com/2322425	REPORT
	https://bugzilla.redhat.com/2322428	REPORT
	https://bugzilla.redhat.com/2322429	REPORT
	https://bugzilla.redhat.com/2322433	REPORT
	https://bugzilla.redhat.com/2322434	REPORT
	https://bugzilla.redhat.com/2322438	REPORT
	https://bugzilla.redhat.com/2322439	REPORT
	https://bugzilla.redhat.com/2322440	REPORT
	https://bugzilla.redhat.com/2322444	REPORT
	https://errata.almalinux.org/9/ALSA-2024-9554.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.4.0-1.el9_5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "firefox-x11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.4.0-1.el9_5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680)\n  * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464)\n  * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461)\n  * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458)\n  * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467)\n  * firefox: thunderbird: Clipboard \"paste\" button persisted across tabs (CVE-2024-10465)\n  * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466)\n  * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463)\n  * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462)\n  * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2024:9554",
  "modified": "2024-11-18T18:09:22Z",
  "published": "2024-11-13T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2024:9554"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10458"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10459"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10460"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10461"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10462"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10463"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10464"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10465"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10466"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-10467"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9680"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2317442"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322424"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322425"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322428"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322429"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322433"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322439"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2322444"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2024-9554.html"
    }
  ],
  "related": [
    "CVE-2024-9680",
    "CVE-2024-10464",
    "CVE-2024-10461",
    "CVE-2024-10458",
    "CVE-2024-10459",
    "CVE-2024-10467",
    "CVE-2024-10465",
    "CVE-2024-10466",
    "CVE-2024-10463",
    "CVE-2024-10462",
    "CVE-2024-10460"
  ],
  "summary": "Important: firefox security update"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-9680 (GCVE-0-2024-9680)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Solutions

Solutions

Solutions

Solutions

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Tags

Sightings

Nomenclature