Security update for MozillaFirefox

2024-06-1811:13:13

Google

osv.dev

mozillafirefox

security update

cve-2024-5702

networking

cve-2024-5688

javascript

cve-2024-5690

protocol handlers

cve-2024-5691

sandbox

cve-2024-5692

file restrictions

cve-2024-5693

cross-origin image

cve-2024-5696

memory corruption

cve-2024-5700

memory safetybugs

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

9.6

Confidence

High

This update for MozillaFirefox fixes the following issues:

Update to version 115.12.0 ESR (bsc#1226027)
CVE-2024-5702: Use-after-free in networking
CVE-2024-5688: Use-after-free in JavaScript object transplant
CVE-2024-5690: External protocol handlers leaked by timing attack
CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
CVE-2024-5692: Bypass of file name restrictions during saving
CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
CVE-2024-5696: Memory Corruption in Text Fragments
CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12