CVE-2024-6612

2024-07-0915:15:13

Alpine Linux Development Team

security.alpinelinux.org

csp violations

dns prefetch

firefox vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

16.0%

JSON

CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.

OSVersionArchitecturePackageVersionFilename
Alpine3.20-communitynoarchfirefox= 126.0.1-r0UNKNOWN
Alpine3.20-communitynoarchthunderbird= 115.11.0-r0UNKNOWN