Ubuntu.comUB:CVE-2024-7531CVE-2024-7531
Calling PK11_Encrypt() in NSS using CKM_CHACHA20 and the same buffer for
input and output can result in plaintext on an Intel Sandy Bridge
processor. In Firefox this only affects the QUIC header protection feature
when the connection is using the ChaCha20-Poly1305 cipher suite. The most
likely outcome is connection failure, but if the connection persists
despite the high packet loss it could be possible for a network observer to
identify packets as coming from the same source despite a network path
change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and
Firefox ESR < 128.1.
Notes
| Author | Note |
|---|---|
| mdeslaur | mozjs* contain a copy of the SpiderMonkey JavaScript engine. It is not feasible to backport security fixes to the mozjs* packages, as such, marking them as ignored. starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap starting with Ubuntu 24.04, the thunderbird package is just a script that installs the Thunderbird snap |
References
bugzilla.mozilla.org/show_bug.cgi?id=1905691
launchpad.net/bugs/cve/CVE-2024-7531
nvd.nist.gov/vuln/detail/CVE-2024-7531
security-tracker.debian.org/tracker/CVE-2024-7531
www.cve.org/CVERecord?id=CVE-2024-7531
www.mozilla.org/en-US/security/advisories/mfsa2024-33/#CVE-2024-7531
www.mozilla.org/en-US/security/advisories/mfsa2024-34/#CVE-2024-7531
www.mozilla.org/security/advisories/mfsa2024-33/
www.mozilla.org/security/advisories/mfsa2024-34/
www.mozilla.org/security/advisories/mfsa2024-35/
Related
