Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-6612

HistoryJul 09, 2024 - 3:15 p.m.

CVE-2024-6612

2024-07-0915:15:13

Debian Security Bug Tracker

security-tracker.debian.org

csp violations

resource link

dns prefetch

firefox vulnerability

unix

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

16.0%

JSON

CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128 and Thunderbird < 128.

OSVersionArchitecturePackageVersionFilename
Debian999allfirefox< 128.0-1firefox_128.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	999	all	firefox	< 128.0-1	firefox_128.0-1_all.deb

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

16.0%

JSON

Related for DEBIANCVE:CVE-2024-6612