Lucene search

K
mozillaMozilla FoundationMFSA2024-15
HistoryMar 22, 2024 - 12:00 a.m.

Security Vulnerabilities fixed in Firefox 124.0.1 — Mozilla

2024-03-2200:00:00
Mozilla Foundation
www.mozilla.org
37
firefox
javascript
out-of-bounds
privilege escalation
desktop
vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

16.1%

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox.

Affected configurations

Vulners
Node
mozillafirefoxRange<124.0.1
VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

16.1%