CVE-2024-3852 — Mozilla Firefox vulnerability

Vendor	Product	Version range	Fixed in
debian	firefox	< firefox 125.0.1-1 (sid)	firefox 125.0.1-1 (sid)
debian	firefox-esr	< firefox 125.0.1-1 (sid)	firefox 125.0.1-1 (sid)
debian	thunderbird	< firefox 125.0.1-1 (sid)	firefox 125.0.1-1 (sid)
mozilla	firefox	< 115.10	115.10
mozilla	firefox	< 125.0	125.0
mozilla	firefox	—	—
mozilla	firefox	>= 0 < 125.0.3+build1-0ubuntu0.20.04.1	125.0.3+build1-0ubuntu0.20.04.1
mozilla	firefox	>= 0 < 125.0.2+build1-0ubuntu0.20.04.2	125.0.2+build1-0ubuntu0.20.04.2
mozilla	firefox	>= unspecified < 125	125
mozilla	firefox_esr	>= unspecified < 115.10	115.10
mozilla	thunderbird	< 115.10	115.10
mozilla	thunderbird	>= 0 < 1:115.10.1-1~deb11u1	1:115.10.1-1~deb11u1
mozilla	thunderbird	>= 0 < 1:115.10.1-1~deb12u1	1:115.10.1-1~deb12u1
mozilla	thunderbird	>= 0 < 1:115.10.1-1	1:115.10.1-1
mozilla	thunderbird	>= 0 < 1:115.10.1-1	1:115.10.1-1
mozilla	thunderbird	>= 0 < 1:115.10.1+build1-0ubuntu0.20.04.1	1:115.10.1+build1-0ubuntu0.20.04.1
mozilla	thunderbird	>= 0 < 1:115.10.1+build1-0ubuntu0.22.04.1	1:115.10.1+build1-0ubuntu0.22.04.1
mozilla	thunderbird	>= unspecified < 115.10	115.10

OSV

firefox regressions

osv·2024-05-02·CVSS 3.7

CVE-2024-3852 [LOW] firefox regressions firefox regressions USN-6747-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-3852, CVE-2024-3864, CVE-2024-3865) Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Gary Kwong discovered that Firefox did not properly manage memory when running garbage collection during realm initialization

OSV

thunderbird vulnerabilities

osv·2024-04-25·CVSS 6.1

CVE-2024-2609 [MEDIUM] thunderbird vulnerabilities thunderbird vulnerabilities Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2024-2609, CVE-2024-3852, CVE-2024-3864) Bartek Nowotarski discovered that Thunderbird did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Lukas Bernhard discovered that Thunderbird did not properly manage memory during JIT optimisations, leading to an out-of-bounds read vulnerability. An attacker could possibly use this issue to cause a denia

OSV

firefox vulnerabilities

osv·2024-04-24·CVSS 3.7

CVE-2024-3852 [LOW] firefox vulnerabilities firefox vulnerabilities Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-3852, CVE-2024-3864, CVE-2024-3865) Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Gary Kwong discovered that Firefox did not properly manage memory when running garbage collection during realm initialization. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-3853) Lukas Bernhard discovered

GHSA

GHSA-pc7c-2483-8558: GetBoundName could return the wrong version of an object when JIT optimizations were applied

ghsa_unreviewed·2024-04-16

CVE-2024-3852 [HIGH] CWE-386 GHSA-pc7c-2483-8558: GetBoundName could return the wrong version of an object when JIT optimizations were applied GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125 and Firefox ESR < 115.10.

OSV

CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied

osv·2024-04-16·CVSS 7.5

CVE-2024-3852 [HIGH] CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

Ubuntu

Firefox regressions

vendor_ubuntu·2024-05-02·CVSS 3.7

[LOW] Firefox regressions Title: Firefox regressions Summary: USN-6747-1 caused some minor regressions in Firefox. USN-6747-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-3852, CVE-2024-3864, CVE-2024-3865) Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Gary Kwong discovered that Firefox did not properly man

Ubuntu

Thunderbird vulnerabilities

vendor_ubuntu·2024-04-25·CVSS 6.1

CVE-2024-3861 [MEDIUM] Thunderbird vulnerabilities Title: Thunderbird vulnerabilities Summary: Several security issues were fixed in Thunderbird. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code. (CVE-2024-2609, CVE-2024-3852, CVE-2024-3864) Bartek Nowotarski discovered that Thunderbird did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Lukas Bernhard discovered that Thunderbird did not properly manage memory during JIT optimisations, leading to an out-of-bounds read vulne

Ubuntu

Firefox vulnerabilities

vendor_ubuntu·2024-04-24·CVSS 3.7

CVE-2024-3853 [LOW] Firefox vulnerabilities Title: Firefox vulnerabilities Summary: Several security issues were fixed in Firefox. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-3852, CVE-2024-3864, CVE-2024-3865) Bartek Nowotarski discovered that Firefox did not properly limit HTTP/2 CONTINUATION frames. An attacker could potentially exploit this issue to cause a denial of service. (CVE-2024-3302) Gary Kwong discovered that Firefox did not properly manage memory when running garbage collection during realm initialization. An attacker could potentially exploit this issue to cause a denial of service, or ex

Red Hat

Mozilla: GetBoundName in the JIT returned the wrong object

vendor_redhat·2024-04-16·CVSS 7.5

CVE-2024-3852 [HIGH] CWE-843 Mozilla: GetBoundName in the JIT returned the wrong object Mozilla: GetBoundName in the JIT returned the wrong object GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. The Mozilla Foundation Security Advisory describes this flaw as: GetBoundName could return the wrong version of an object when JIT optimizations were applied. Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope

Debian

CVE-2024-3852: firefox - GetBoundName could return the wrong version of an object when JIT optimizations ...

vendor_debian·2024·CVSS 7.5

CVE-2024-3852 [HIGH] CVE-2024-3852: firefox - GetBoundName could return the wrong version of an object when JIT optimizations ... GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. Scope: local sid: resolved (fixed in 125.0.1-1)

Mozilla

Mozilla Foundation Security Advisory 2024-20: CVE-2024-3852

vendor_mozilla·CVSS 7.5

CVE-2024-3852 [HIGH] Mozilla Foundation Security Advisory 2024-20: CVE-2024-3852 Mozilla Foundation Security Advisory 2024-20 CVE: CVE-2024-3852 Product: Thunderbird Impact: high Fixed in: Thunderbird 115.10

Mozilla

Mozilla Foundation Security Advisory 2024-18: CVE-2024-3852

vendor_mozilla·CVSS 7.5

CVE-2024-3852 [HIGH] Mozilla Foundation Security Advisory 2024-18: CVE-2024-3852 Mozilla Foundation Security Advisory 2024-18 CVE: CVE-2024-3852 Product: Firefox Impact: high Fixed in: Firefox 125

Mozilla

Mozilla Foundation Security Advisory 2024-19: CVE-2024-3852

vendor_mozilla·CVSS 7.5

CVE-2024-3852 [HIGH] Mozilla Foundation Security Advisory 2024-19: CVE-2024-3852 Mozilla Foundation Security Advisory 2024-19 CVE: CVE-2024-3852 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.10

CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10…

Affected

CVSS provenance