CVE-2024-6609
published 2024-07-09CVE-2024-6609: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird…
PriorityP340high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.58%
43.6th percentile
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 128.0-1 (sid) | firefox 128.0-1 (sid) |
| debian | nss | < firefox 128.0-1 (sid) | firefox 128.0-1 (sid) |
| mozilla | firefox | < 128.0 | 128.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 128.0+build2-0ubuntu0.20.04.1 | 128.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 128 | 128 |
| mozilla | nss | >= 0 < 2:3.61-1+deb11u4 | 2:3.61-1+deb11u4 |
| mozilla | nss | >= 0 < 2:3.87.1-1+deb12u1 | 2:3.87.1-1+deb12u1 |
| mozilla | nss | >= 0 < 2:3.101-1 | 2:3.101-1 |
| mozilla | nss | >= 0 < 2:3.101-1 | 2:3.101-1 |
| mozilla | thunderbird | < 128.0 | 128.0 |
| mozilla | thunderbird | >= unspecified < 128 | 128 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
firefox vulnerabilities
osv·2024-07-10·CVSS 4.7
CVE-2024-6601 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-6601,
CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611,
CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615)
It was discovered that Firefox did not properly manage certain memory
operations in the NSS. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-6602,
CVE-2024-6609)
Irvan Kurniawan discovered that Firefox did not properly manage memory
during thread creation. An attacker could potentially exp
OSV
CVE-2024-6609: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again
osv·2024-07-09·CVSS 8.8
CVE-2024-6609 [HIGH] CVE-2024-6609: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
GHSA
GHSA-xcm3-jhmr-9fhh: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again
ghsa_unreviewed·2024-07-09
CVE-2024-6609 [HIGH] GHSA-xcm3-jhmr-9fhh: When almost out-of-memory an elliptic curve key which was never allocated could have been freed again
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2024-07-10·CVSS 4.7
CVE-2024-6612 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-6601,
CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611,
CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615)
It was discovered that Firefox did not properly manage certain memory
operations in the NSS. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-6602,
CVE-2024-6609)
Irvan Kurniawan discovered that Firefox did not properly manage
Debian
CVE-2024-6609: firefox - When almost out-of-memory an elliptic curve key which was never allocated could ...
vendor_debian·2024·CVSS 8.8
CVE-2024-6609 [HIGH] CVE-2024-6609: firefox - When almost out-of-memory an elliptic curve key which was never allocated could ...
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.
Scope: local
sid: resolved (fixed in 128.0-1)
Mozilla
Mozilla Foundation Security Advisory 2024-32: CVE-2024-6609
vendor_mozilla·CVSS 8.8
CVE-2024-6609 [HIGH] Mozilla Foundation Security Advisory 2024-32: CVE-2024-6609
Mozilla Foundation Security Advisory 2024-32
CVE: CVE-2024-6609
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 128
Mozilla
Mozilla Foundation Security Advisory 2024-29: CVE-2024-6609
vendor_mozilla·CVSS 8.8
CVE-2024-6609 [HIGH] Mozilla Foundation Security Advisory 2024-29: CVE-2024-6609
Mozilla Foundation Security Advisory 2024-29
CVE: CVE-2024-6609
Product: Firefox
Impact: high
Fixed in: Firefox 128
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1839258https://www.mozilla.org/security/advisories/mfsa2024-29/https://www.mozilla.org/security/advisories/mfsa2024-32/https://bugzilla.mozilla.org/show_bug.cgi?id=1839258https://lists.debian.org/debian-lts-announce/2024/10/msg00028.htmlhttps://www.mozilla.org/security/advisories/mfsa2024-29/https://www.mozilla.org/security/advisories/mfsa2024-32/
2024-07-09
Published