CVE-2024-3302
published 2024-04-16CVE-2024-3302: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the…
low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 125.0.1-1 (sid) | firefox 125.0.1-1 (sid) |
| debian | firefox-esr | < firefox 125.0.1-1 (sid) | firefox 125.0.1-1 (sid) |
| debian | thunderbird | < firefox 125.0.1-1 (sid) | firefox 125.0.1-1 (sid) |
| mozilla | firefox | < 115.10 | 115.10 |
| mozilla | firefox | < 125.0 | 125.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 125.0.3+build1-0ubuntu0.20.04.1 | 125.0.3+build1-0ubuntu0.20.04.1 |
| mozilla | firefox | >= 0 < 125.0.2+build1-0ubuntu0.20.04.2 | 125.0.2+build1-0ubuntu0.20.04.2 |
| mozilla | firefox | >= unspecified < 125 | 125 |
| mozilla | firefox_esr | >= unspecified < 115.10 | 115.10 |
| mozilla | thunderbird | <= 115.10 | — |
| mozilla | thunderbird | >= 0 < 1:115.10.1-1~deb11u1 | 1:115.10.1-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:115.10.1-1~deb12u1 | 1:115.10.1-1~deb12u1 |
| mozilla | thunderbird | >= 0 < 1:115.10.1-1 | 1:115.10.1-1 |
| mozilla | thunderbird | >= 0 < 1:115.10.1-1 | 1:115.10.1-1 |
| mozilla | thunderbird | >= 0 < 1:115.10.1+build1-0ubuntu0.20.04.1 | 1:115.10.1+build1-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:115.10.1+build1-0ubuntu0.22.04.1 | 1:115.10.1+build1-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 115.10 | 115.10 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
osv6.1MEDIUM
OSV
firefox regressions
osv·2024-05-02·CVSS 3.7
CVE-2024-3852 [LOW] firefox regressions
firefox regressions
USN-6747-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-3852,
CVE-2024-3864, CVE-2024-3865)
Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Gary Kwong discovered that Firefox did not properly manage memory when
running garbage collection during realm initialization
OSV
thunderbird vulnerabilities
osv·2024-04-25·CVSS 6.1
CVE-2024-2609 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-2609, CVE-2024-3852,
CVE-2024-3864)
Bartek Nowotarski discovered that Thunderbird did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Lukas Bernhard discovered that Thunderbird did not properly manage memory
during JIT optimisations, leading to an out-of-bounds read vulnerability.
An attacker could possibly use this issue to cause a denia
OSV
firefox vulnerabilities
osv·2024-04-24·CVSS 3.7
CVE-2024-3852 [LOW] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-3852,
CVE-2024-3864, CVE-2024-3865)
Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Gary Kwong discovered that Firefox did not properly manage memory when
running garbage collection during realm initialization. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-3853)
Lukas Bernhard discovered
OSV
CVE-2024-3302: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed
osv·2024-04-16·CVSS 3.7
CVE-2024-3302 [LOW] CVE-2024-3302: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
GHSA
GHSA-p6gp-c388-p4cr: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed
ghsa_unreviewed·2024-04-16
CVE-2024-3302 [LOW] CWE-770 GHSA-p6gp-c388-p4cr: There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125 and Firefox ESR < 115.10.
Ubuntu
Firefox regressions
vendor_ubuntu·2024-05-02·CVSS 3.7
[LOW] Firefox regressions
Title: Firefox regressions
Summary: USN-6747-1 caused some minor regressions in Firefox.
USN-6747-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-3852,
CVE-2024-3864, CVE-2024-3865)
Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Gary Kwong discovered that Firefox did not properly man
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2024-04-25·CVSS 6.1
CVE-2024-3861 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-2609, CVE-2024-3852,
CVE-2024-3864)
Bartek Nowotarski discovered that Thunderbird did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Lukas Bernhard discovered that Thunderbird did not properly manage memory
during JIT optimisations, leading to an out-of-bounds read vulne
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2024-04-24·CVSS 3.7
CVE-2024-3853 [LOW] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-3852,
CVE-2024-3864, CVE-2024-3865)
Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2
CONTINUATION frames. An attacker could potentially exploit this issue to
cause a denial of service. (CVE-2024-3302)
Gary Kwong discovered that Firefox did not properly manage memory when
running garbage collection during realm initialization. An attacker could
potentially exploit this issue to cause a denial of service, or ex
Red Hat
Mozilla: Denial of Service using HTTP/2 CONTINUATION frames
vendor_redhat·2024-04-16·CVSS 3.7
CVE-2024-3302 [LOW] CWE-400 Mozilla: Denial of Service using HTTP/2 CONTINUATION frames
Mozilla: Denial of Service using HTTP/2 CONTINUATION frames
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
The Mozilla Foundation Security Advisory describes this flaw as:
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6)
Debian
CVE-2024-3302: firefox - There was no limit to the number of HTTP/2 CONTINUATION frames that would be pro...
vendor_debian·2024·CVSS 3.7
CVE-2024-3302 [LOW] CVE-2024-3302: firefox - There was no limit to the number of HTTP/2 CONTINUATION frames that would be pro...
There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
Scope: local
sid: resolved (fixed in 125.0.1-1)
Mozilla
Mozilla Foundation Security Advisory 2024-19: CVE-2024-3302
vendor_mozilla·CVSS 3.7
CVE-2024-3302 [LOW] Mozilla Foundation Security Advisory 2024-19: CVE-2024-3302
Mozilla Foundation Security Advisory 2024-19
CVE: CVE-2024-3302
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.10
Mozilla
Mozilla Foundation Security Advisory 2024-20: CVE-2024-3302
vendor_mozilla·CVSS 3.7
CVE-2024-3302 [LOW] Mozilla Foundation Security Advisory 2024-20: CVE-2024-3302
Mozilla Foundation Security Advisory 2024-20
CVE: CVE-2024-3302
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 115.10
Mozilla
Mozilla Foundation Security Advisory 2024-18: CVE-2024-3302
vendor_mozilla·CVSS 3.7
CVE-2024-3302 [LOW] Mozilla Foundation Security Advisory 2024-18: CVE-2024-3302
Mozilla Foundation Security Advisory 2024-18
CVE: CVE-2024-3302
Product: Firefox
Impact: high
Fixed in: Firefox 125
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1881183https://kb.cert.org/vuls/id/421644https://lists.debian.org/debian-lts-announce/2024/04/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2024/04/msg00013.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-18/https://www.mozilla.org/security/advisories/mfsa2024-19/https://www.mozilla.org/security/advisories/mfsa2024-20/https://bugzilla.mozilla.org/show_bug.cgi?id=1881183https://kb.cert.org/vuls/id/421644https://lists.debian.org/debian-lts-announce/2024/04/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2024/04/msg00013.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-18/https://www.mozilla.org/security/advisories/mfsa2024-19/https://www.mozilla.org/security/advisories/mfsa2024-20/
2024-04-16
Published