CVE-2024-6607
published 2024-07-09CVE-2024-6607: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over certain…
PriorityP344high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.56%
43.0th percentile
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 128.0-1 (sid) | firefox 128.0-1 (sid) |
| mozilla | firefox | < 128.0 | 128.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 128.0+build2-0ubuntu0.20.04.1 | 128.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 128 | 128 |
| mozilla | thunderbird | < 128.0 | 128.0 |
| mozilla | thunderbird | >= unspecified < 128 | 128 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
firefox vulnerabilities
osv·2024-07-10·CVSS 4.7
CVE-2024-6601 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-6601,
CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611,
CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615)
It was discovered that Firefox did not properly manage certain memory
operations in the NSS. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-6602,
CVE-2024-6609)
Irvan Kurniawan discovered that Firefox did not properly manage memory
during thread creation. An attacker could potentially exp
OSV
CVE-2024-6607: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over ce
osv·2024-07-10·CVSS 8.8
CVE-2024-6607 [HIGH] CVE-2024-6607: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over ce
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.
GHSA
GHSA-gq55-cjrv-p49j: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over ce
ghsa_unreviewed·2024-07-09
CVE-2024-6607 [HIGH] CWE-763 GHSA-gq55-cjrv-p49j: It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over ce
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2024-07-10·CVSS 4.7
CVE-2024-6612 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-6601,
CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611,
CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615)
It was discovered that Firefox did not properly manage certain memory
operations in the NSS. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-6602,
CVE-2024-6609)
Irvan Kurniawan discovered that Firefox did not properly manage
Debian
CVE-2024-6607: firefox - It was possible to prevent a user from exiting pointerlock when pressing escape ...
vendor_debian·2024·CVSS 8.8
CVE-2024-6607 [HIGH] CVE-2024-6607: firefox - It was possible to prevent a user from exiting pointerlock when pressing escape ...
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a ` ` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Scope: local
sid: resolved (fixed in 128.0-1)
Mozilla
Mozilla Foundation Security Advisory 2024-29: CVE-2024-6607
vendor_mozilla·CVSS 8.8
CVE-2024-6607 [HIGH] Mozilla Foundation Security Advisory 2024-29: CVE-2024-6607
Mozilla Foundation Security Advisory 2024-29
CVE: CVE-2024-6607
Product: Firefox
Impact: high
Fixed in: Firefox 128
Mozilla
Mozilla Foundation Security Advisory 2024-32: CVE-2024-6607
vendor_mozilla·CVSS 8.8
CVE-2024-6607 [HIGH] Mozilla Foundation Security Advisory 2024-32: CVE-2024-6607
Mozilla Foundation Security Advisory 2024-32
CVE: CVE-2024-6607
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 128
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1694513https://www.mozilla.org/security/advisories/mfsa2024-29/https://www.mozilla.org/security/advisories/mfsa2024-32/https://bugzilla.mozilla.org/show_bug.cgi?id=1694513https://www.mozilla.org/security/advisories/mfsa2024-29/https://www.mozilla.org/security/advisories/mfsa2024-32/
2024-07-09
Published