CVE-2024-4770 — Use After Free in Mozilla Firefox

CWE-416 — Use After Free12 documents9 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 35.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird
Timeline
PublishedMay 14
Latest updateMay 22

Description

When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5mozilla/firefoxunspecified — 126
▶NVDmozilla/firefox< 115.11.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 115.11
▶CVEListV5mozilla/thunderbirdunspecified — 115.11
▶NVDmozilla/thunderbird< 115.11.0

🔴Vulnerability Details

3
GHSA
GHSA-7ggp-cp85-r5cg: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash↗2024-05-14
▶
OSV
CVE-2024-4770: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash↗2024-05-14
▶
CVEList
CVE-2024-4770: When saving a page to PDF, certain font styles could have led to a potential use-after-free crash↗2024-05-14
▶

📋Vendor Advisories

8
Ubuntu
Thunderbird vulnerabilities↗2024-05-22
▶
Ubuntu
Firefox vulnerabilities↗2024-05-21
▶
Red Hat
Mozilla: Use-after-free could occur when printing to PDF↗2024-05-14
▶
Microsoft
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.↗2024-05-14
▶
Debian
CVE-2024-4770: firefox - When saving a page to PDF, certain font styles could have led to a potential use...↗2024
▶
CVE-2024-4770 — Use After Free in Mozilla Firefox | cvebase