Lucene search

K

[email protected]NVD:CVE-2024-29944

HistoryMar 22, 2024 - 1:15 p.m.

CVE-2024-29944

2024-03-2213:15:07

[email protected]

web.nvd.nist.gov

7

event handler

javascript execution

parent process

desktop firefox

vulnerability

firefox esr

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0

Percentile

15.5%

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

References

www.openwall.com/lists/oss-security/2024/03/23/1

bugzilla.mozilla.org/show_bug.cgi?id=1886852

lists.debian.org/debian-lts-announce/2024/03/msg00028.html

www.mozilla.org/security/advisories/mfsa2024-15/

www.mozilla.org/security/advisories/mfsa2024-16/

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0

Percentile

15.5%

Related for NVD:CVE-2024-29944