Lucene search

K
almalinuxAlmaLinuxALSA-2024:3783
HistoryJun 10, 2024 - 12:00 a.m.

Moderate: firefox security update

2024-06-1000:00:00
errata.almalinux.org
14
mozilla firefox
esr
security update
cve-2024-4367
cve-2024-4767
cve-2024-4768
cve-2024-4769
cve-2024-4770
cve-2024-4777
security fix

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.

This update upgrades Firefox to version 115.11.0 ESR.

Security Fix(es):

  • firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
  • firefox: IndexedDB files retained in private browsing mode (CVE-2024-4767)
  • firefox: Potential permissions request bypass via clickjacking (CVE-2024-4768)
  • firefox: Cross-origin responses could be distinguished between script and
    non-script content-types (CVE-2024-4769)
  • firefox: Use-after-free could occur when printing to PDF (CVE-2024-4770)
  • firefox: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and
    Thunderbird 115.11 (CVE-2024-4777)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High