CVE-2024-2613 — UI Misrepresentation / Clickjacking

Vendor	Product	Version range	Fixed in
debian	firefox	< firefox 124.0-1 (sid)	firefox 124.0-1 (sid)
mozilla	firefox	< 124.0	124.0
mozilla	firefox	—	—
mozilla	firefox	>= 0 < 124.0+build1-0ubuntu0.20.04.1	124.0+build1-0ubuntu0.20.04.1
mozilla	firefox	>= unspecified < 124	124

Red Hat

kernel: io_uring: fix error pbuf checking

vendor_redhat·2024-08-08·CVSS 5.5

CVE-2024-42254 [MEDIUM] kernel: io_uring: fix error pbuf checking kernel: io_uring: fix error pbuf checking In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341 Call Trace: io_put_bl io_uring/kbuf.c:378 [inline] io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:3

Ubuntu

Firefox vulnerabilities

vendor_ubuntu·2024-03-20·CVSS 6.5

CVE-2024-2610 [MEDIUM] Firefox vulnerabilities Title: Firefox vulnerabilities Summary: Several security issues were fixed in Firefox. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-2609, CVE-2024-2611, CVE-2024-2614, CVE-2024-2615) Hubert Kario discovered that Firefox had a timing side-channel when performing RSA decryption. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2023-5388) It was discovered that Firefox did not properly handle WASM register values in some circumstances. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-260

Debian

CVE-2024-2613: firefox - Data was not properly sanitized when decoding a QUIC ACK frame; this could have ...

vendor_debian·2024·CVSS 7.5

CVE-2024-2613 [HIGH] CVE-2024-2613: firefox - Data was not properly sanitized when decoding a QUIC ACK frame; this could have ... Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124. Scope: local sid: resolved (fixed in 124.0-1)

Mozilla

Mozilla Foundation Security Advisory 2024-12: CVE-2024-2613

vendor_mozilla·CVSS 7.5

CVE-2024-2613 [HIGH] Mozilla Foundation Security Advisory 2024-12: CVE-2024-2613 Mozilla Foundation Security Advisory 2024-12 CVE: CVE-2024-2613 Product: Firefox Impact: critical Fixed in: Firefox 124

OSV

firefox vulnerabilities

osv·2024-03-20·CVSS 6.5

CVE-2024-2609 [MEDIUM] firefox vulnerabilities firefox vulnerabilities Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-2609, CVE-2024-2611, CVE-2024-2614, CVE-2024-2615) Hubert Kario discovered that Firefox had a timing side-channel when performing RSA decryption. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2023-5388) It was discovered that Firefox did not properly handle WASM register values in some circumstances. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-2606) Gary Kwong discovered that Firefox incorrectly updated retur

OSV

CVE-2024-2613: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash

osv·2024-03-19·CVSS 7.5

CVE-2024-2613 [HIGH] CVE-2024-2613: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.

GHSA

GHSA-pvg5-mc56-6fv7: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash

ghsa_unreviewed·2024-03-19

CVE-2024-2613 [HIGH] CWE-1021 GHSA-pvg5-mc56-6fv7: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.

CVE-2024-2613: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects…

Affected

CVSS provenance