CVE-2024-2608 — Integer Overflow to Buffer Overflow in Mozilla Firefox

CWE-680 — Integer Overflow to Buffer OverflowCWE-190 — Integer Overflow or WraparoundCWE-120 — Classic Buffer Overflow11 documents8 sources
Severity
8.4HIGHNVD
EPSS
0.2%
top 59.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+1 more
Timeline
PublishedMar 19
Latest updateMar 26

Description

`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5mozilla/firefoxunspecified — 124
▶NVDmozilla/firefox< 115.9.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 115.9
▶CVEListV5mozilla/thunderbirdunspecified — 115.9
▶NVDmozilla/thunderbird< 115.9.0

Also affects: Debian Linux 10.0

🔴Vulnerability Details

3
GHSA
GHSA-9crf-rxmh-772m: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing u↗2024-03-19
▶
OSV
CVE-2024-2608: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing u↗2024-03-19
▶
CVEList
CVE-2024-2608: `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing u↗2024-03-19
▶

📋Vendor Advisories

7
Ubuntu
Thunderbird vulnerabilities↗2024-03-26
▶
Ubuntu
Firefox vulnerabilities↗2024-03-20
▶
Red Hat
Mozilla: Integer overflow could have led to out of bounds write↗2024-03-19
▶
Debian
CVE-2024-2608: firefox - `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEn...↗2024
▶
Mozilla
Mozilla Foundation Security Advisory 2024-12: CVE-2024-2608↗
▶
CVE-2024-2608 — Integer Overflow to Buffer Overflow | cvebase