CVE-2024-3864 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120 — Classic Buffer Overflow14 documents8 sources

Severity

8.1HIGHNVD

OSV6.1OSV3.7

EPSS

1.1%

top 22.26%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird +1 more

Timeline

PublishedApr 16

Latest updateMay 2

Description

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages8 packages

▶CVEListV5mozilla/firefoxunspecified — 125

▶NVDmozilla/firefox< 115.10.0+1

▶CVEListV5mozilla/firefox_esrunspecified — 115.10

▶Ubuntumozilla/firefox< 125.0.3+build1-0ubuntu0.20.04.1+1

▶CVEListV5mozilla/thunderbirdunspecified — 115.10

Also affects: Debian Linux 10.0

🔴Vulnerability Details

OSV

firefox regressions↗2024-05-02

▶

OSV

thunderbird vulnerabilities↗2024-04-25

▶

OSV

firefox vulnerabilities↗2024-04-24

▶

CVEList

CVE-2024-3864: Memory safety bug present in Firefox 124, Firefox ESR 115↗2024-04-16

▶

GHSA

GHSA-w74w-xq97-pg62: Memory safety bug present in Firefox 124, Firefox ESR 115↗2024-04-16

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2024-04-25

▶

Ubuntu

Firefox vulnerabilities↗2024-04-24

▶

Red Hat

Mozilla: Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10↗2024-04-16

▶

Debian

CVE-2024-3864: firefox - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115...↗2024

▶

Mozilla

Mozilla Foundation Security Advisory 2024-18: CVE-2024-3864↗

▶