Security update for MozillaFirefox

2024-06-1216:40:30

Google

osv.dev

mozillafirefox

security update

use-after-free

external protocol handlers

sandbox bypass

file name restrictions

memory corruption

memory safety bugs

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

7.9

Confidence

High

This update for MozillaFirefox fixes the following issues:

Update to version 115.12.0 ESR (bsc#1226027)
CVE-2024-5702: Use-after-free in networking
CVE-2024-5688: Use-after-free in JavaScript object transplant
CVE-2024-5690: External protocol handlers leaked by timing attack
CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
CVE-2024-5692: Bypass of file name restrictions during saving
CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
CVE-2024-5696: Memory Corruption in Text Fragments
CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12