CVE-2024-6611 — Mozilla Firefox vulnerability

Vendor	Product	Version range	Fixed in
debian	firefox	< firefox 128.0-1 (sid)	firefox 128.0-1 (sid)
mozilla	firefox	< 128.0	128.0
mozilla	firefox	—	—
mozilla	firefox	>= 0 < 128.0+build2-0ubuntu0.20.04.1	128.0+build2-0ubuntu0.20.04.1
mozilla	firefox	>= unspecified < 128	128
mozilla	thunderbird	< 128.0	128.0
mozilla	thunderbird	>= unspecified < 128	128
msrc	azl3_mozjs_102.15.1-1_on_azure_linux_3.0	—	—

OSV

firefox vulnerabilities

osv·2024-07-10·CVSS 4.7

CVE-2024-6601 [MEDIUM] firefox vulnerabilities firefox vulnerabilities Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-6601, CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611, CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615) It was discovered that Firefox did not properly manage certain memory operations in the NSS. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-6602, CVE-2024-6609) Irvan Kurniawan discovered that Firefox did not properly manage memory during thread creation. An attacker could potentially exp

OSV

CVE-2024-6611: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

osv·2024-07-10·CVSS 9.8

CVE-2024-6611 [CRITICAL] CVE-2024-6611: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

GHSA

GHSA-hr59-q2gm-7hrj: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

ghsa_unreviewed·2024-07-09

CVE-2024-6611 [CRITICAL] CWE-1275 GHSA-hr59-q2gm-7hrj: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128.

Ubuntu

Firefox vulnerabilities

vendor_ubuntu·2024-07-10·CVSS 4.7

CVE-2024-6612 [MEDIUM] Firefox vulnerabilities Title: Firefox vulnerabilities Summary: Several security issues were fixed in Firefox. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. (CVE-2024-6601, CVE-2024-6604, CVE-2024-6607, CVE-2024-6608, CVE-2024-6610, CVE-2024-6611, CVE-2024-6612, CVE-2024-6613, CVE-2024-6614, CVE-2024-6615) It was discovered that Firefox did not properly manage certain memory operations in the NSS. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. (CVE-2024-6602, CVE-2024-6609) Irvan Kurniawan discovered that Firefox did not properly manage

Microsoft

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

vendor_msrc·2024-07-09·CVSS 9.8

CVE-2024-6611 [CRITICAL] CWE-1275 A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128. A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner mozilla: mozilla Customer Action R

Debian

CVE-2024-6611: firefox - A nested iframe, triggering a cross-site navigation, could send SameSite=Strict ...

vendor_debian·2024·CVSS 9.8

CVE-2024-6611 [CRITICAL] CVE-2024-6611: firefox - A nested iframe, triggering a cross-site navigation, could send SameSite=Strict ... A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128. Scope: local sid: resolved (fixed in 128.0-1)

Mozilla

Mozilla Foundation Security Advisory 2024-32: CVE-2024-6611

vendor_mozilla·CVSS 9.8

CVE-2024-6611 [CRITICAL] Mozilla Foundation Security Advisory 2024-32: CVE-2024-6611 Mozilla Foundation Security Advisory 2024-32 CVE: CVE-2024-6611 Product: Thunderbird Impact: high Fixed in: Thunderbird 128

Mozilla

Mozilla Foundation Security Advisory 2024-29: CVE-2024-6611

vendor_mozilla·CVSS 9.8

CVE-2024-6611 [CRITICAL] Mozilla Foundation Security Advisory 2024-29: CVE-2024-6611 Mozilla Foundation Security Advisory 2024-29 CVE: CVE-2024-6611 Product: Firefox Impact: high Fixed in: Firefox 128

CVE-2024-6611: A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Affected

CVSS provenance