CVE-2024-4764 — Use After Free in Mozilla Firefox

Vendor	Product	Version range	Fixed in
debian	firefox	< firefox 126.0-1 (sid)	firefox 126.0-1 (sid)
mozilla	firefox	< 126.0	126.0
mozilla	firefox	—	—
mozilla	firefox	>= 0 < 126.0+build2-0ubuntu0.20.04.1	126.0+build2-0ubuntu0.20.04.1
mozilla	firefox	>= 0 < 126.0.1+build1-0ubuntu0.20.04.1	126.0.1+build1-0ubuntu0.20.04.1
mozilla	firefox	>= unspecified < 126	126

Ubuntu

Firefox regressions

vendor_ubuntu·2024-05-29·CVSS 8.8

[HIGH] Firefox regressions Title: Firefox regressions Summary: USN-6779-1 caused some minor regressions in Firefox. USN-6779-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773, CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778) Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory when audio input connected with multiple consumers.

Ubuntu

Firefox vulnerabilities

vendor_ubuntu·2024-05-21·CVSS 8.8

CVE-2024-4768 [HIGH] Firefox vulnerabilities Title: Firefox vulnerabilities Summary: Several security issues were fixed in Firefox. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773, CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778) Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory when audio input connected with multiple consumers. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-4764) Thomas Rinsma discovered that Fi

Debian

CVE-2024-4764: firefox - Multiple WebRTC threads could have claimed a newly connected audio input leading...

vendor_debian·2024·CVSS 9.8

CVE-2024-4764 [CRITICAL] CVE-2024-4764: firefox - Multiple WebRTC threads could have claimed a newly connected audio input leading... Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126. Scope: local sid: resolved (fixed in 126.0-1)

Mozilla

Mozilla Foundation Security Advisory 2024-21: CVE-2024-4764

vendor_mozilla·CVSS 9.8

CVE-2024-4764 [CRITICAL] Mozilla Foundation Security Advisory 2024-21: CVE-2024-4764 Mozilla Foundation Security Advisory 2024-21 CVE: CVE-2024-4764 Product: Firefox Impact: moderate Fixed in: Firefox 126

OSV

firefox regressions

osv·2024-05-29·CVSS 8.8

CVE-2024-4767 [HIGH] firefox regressions firefox regressions USN-6779-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773, CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778) Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory when audio input connected with multiple consumers. An attacker could potentially exploit this issue to cause a denial of

OSV

firefox vulnerabilities

osv·2024-05-21·CVSS 8.8

CVE-2024-4767 [HIGH] firefox vulnerabilities firefox vulnerabilities Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-4767, CVE-2024-4768, CVE-2024-4769, CVE-2024-4771, CVE-2024-4772, CVE-2024-4773, CVE-2024-4774, CVE-2024-4775, CVE-2024-4776, CVE-2024-4777, CVE-2024-4778) Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory when audio input connected with multiple consumers. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-4764) Thomas Rinsma discovered that Firefox did not properly handle type check when handling fonts in

OSV

CVE-2024-4764: Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free

osv·2024-05-14·CVSS 9.8

CVE-2024-4764 [CRITICAL] CVE-2024-4764: Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.

GHSA

GHSA-rqmx-jjch-gmgj: Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free

ghsa_unreviewed·2024-05-14

CVE-2024-4764 [CRITICAL] CWE-416 GHSA-rqmx-jjch-gmgj: Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.

CVE-2024-4764: Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.

Affected

CVSS provenance