CVE-2024-5702
published 2024-06-11CVE-2024-5702: Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox-esr | < firefox-esr 115.12.0esr-1~deb12u1 (bookworm) | firefox-esr 115.12.0esr-1~deb12u1 (bookworm) |
| debian | thunderbird | < firefox-esr 115.12.0esr-1~deb12u1 (bookworm) | firefox-esr 115.12.0esr-1~deb12u1 (bookworm) |
| mozilla | firefox | < 115.12 | 115.12 |
| mozilla | firefox | < 125.0 | 125.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 125 | 125 |
| mozilla | firefox_esr | >= unspecified < 115.12 | 115.12 |
| mozilla | thunderbird | < 115.12 | 115.12 |
| mozilla | thunderbird | >= 0 < 1:115.12.0-1~deb11u1 | 1:115.12.0-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:115.12.0-1~deb12u1 | 1:115.12.0-1~deb12u1 |
| mozilla | thunderbird | >= 0 < 1:115.12.0-1 | 1:115.12.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.12.0-1 | 1:115.12.0-1 |
| mozilla | thunderbird | >= 0 < 1:115.12.0+build3-0ubuntu0.20.04.1 | 1:115.12.0+build3-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:115.12.0+build3-0ubuntu0.22.04.1 | 1:115.12.0+build3-0ubuntu0.22.04.1 |
| mozilla | thunderbird | >= unspecified < 115.12 | 115.12 |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv8.1HIGH
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2024-06-19·CVSS 8.1
CVE-2024-5688 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.(CVE-2024-5688, CVE-2024-5690,
CVE-2024-5696, CVE-2024-5700, CVE-2024-5702)
Luan Herrera discovered that Thunderbird did not properly validate the
X-Frame-Options header inside sandboxed iframe. An attacker could
potentially exploit this issue to bypass sandbox restrictions to open a new
window. (CVE-2024-5691)
Kirtikumar Anandrao Ramchandani discovered that Thunderbird did
Microsoft
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
vendor_msrc·2024-06-11·CVSS 7.5
CVE-2024-5702 [HIGH] CWE-416 Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mozilla: mozilla
Customer Action Requ
Red Hat
Mozilla: Use-after-free in networking
vendor_redhat·2024-06-11·CVSS 7.5
CVE-2024-5702 [HIGH] CWE-416 Mozilla: Use-after-free in networking
Mozilla: Use-after-free in networking
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
The Mozilla Foundation Security Advisory describes this flaw as:
Memory corruption in the networking stack could have led to a potentially exploitable crash.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Debian
CVE-2024-5702: firefox-esr - Memory corruption in the networking stack could have led to a potentially exploi...
vendor_debian·2024·CVSS 7.5
CVE-2024-5702 [HIGH] CVE-2024-5702: firefox-esr - Memory corruption in the networking stack could have led to a potentially exploi...
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
Scope: local
bookworm: resolved (fixed in 115.12.0esr-1~deb12u1)
bullseye: resolved (fixed in 115.12.0esr-1~deb11u1)
forky: resolved (fixed in 115.12.0esr-1)
sid: resolved (fixed in 115.12.0esr-1)
trixie: resolved (fixed in 115.12.0esr-1)
Mozilla
Mozilla Foundation Security Advisory 2024-18: CVE-2024-5702
vendor_mozilla·CVSS 7.5
CVE-2024-5702 [HIGH] Mozilla Foundation Security Advisory 2024-18: CVE-2024-5702
Mozilla Foundation Security Advisory 2024-18
CVE: CVE-2024-5702
Product: Firefox
Impact: high
Fixed in: Firefox 125
Mozilla
Mozilla Foundation Security Advisory 2024-26: CVE-2024-5702
vendor_mozilla·CVSS 7.5
CVE-2024-5702 [HIGH] Mozilla Foundation Security Advisory 2024-26: CVE-2024-5702
Mozilla Foundation Security Advisory 2024-26
CVE: CVE-2024-5702
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 115.12
Mozilla
Mozilla Foundation Security Advisory 2024-28: CVE-2024-5702
vendor_mozilla·CVSS 7.5
CVE-2024-5702 [HIGH] Mozilla Foundation Security Advisory 2024-28: CVE-2024-5702
Mozilla Foundation Security Advisory 2024-28
CVE: CVE-2024-5702
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 115.12
OSV
thunderbird vulnerabilities
osv·2024-06-19·CVSS 8.1
CVE-2024-5688 [HIGH] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.(CVE-2024-5688, CVE-2024-5690,
CVE-2024-5696, CVE-2024-5700, CVE-2024-5702)
Luan Herrera discovered that Thunderbird did not properly validate the
X-Frame-Options header inside sandboxed iframe. An attacker could
potentially exploit this issue to bypass sandbox restrictions to open a new
window. (CVE-2024-5691)
Kirtikumar Anandrao Ramchandani discovered that Thunderbird did not properly
track cross-origin tainting in Offscreen Canvas. An att
OSV
CVE-2024-5702: Memory corruption in the networking stack could have led to a potentially exploitable crash
osv·2024-06-11·CVSS 7.5
CVE-2024-5702 [HIGH] CVE-2024-5702: Memory corruption in the networking stack could have led to a potentially exploitable crash
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.
GHSA
GHSA-gc3q-f2fq-g2xq: Memory corruption in the networking stack could have led to a potentially exploitable crash
ghsa_unreviewed·2024-06-11
CVE-2024-5702 [HIGH] CWE-416 GHSA-gc3q-f2fq-g2xq: Memory corruption in the networking stack could have led to a potentially exploitable crash
Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125 and Firefox ESR < 115.12.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1193389https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-18/https://www.mozilla.org/security/advisories/mfsa2024-26/https://www.mozilla.org/security/advisories/mfsa2024-28/https://bugzilla.mozilla.org/show_bug.cgi?id=1193389https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlhttps://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-18/https://www.mozilla.org/security/advisories/mfsa2024-26/https://www.mozilla.org/security/advisories/mfsa2024-28/
2024-06-11
Published