Critical Firefox Security Update (ALSA-2024:1484)
Summary
ALSA-2024:1484: Critical: firefox security update. Affects firefox versions < 115.9.1-1.el8_9.alma.1. Fixed in 115.9.1-1.el8_9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is an open-source web browser known for its compliance with web standards, performance, and portability. It is widely used by individuals and organizations for browsing the internet. However, a critical security vulnerability has been discovered in Firefox.
Vulnerability Detail
The vulnerability (CVE-2024-1484) affects Firefox versions prior to 115.9.1 ESR. It includes multiple security fixes that address various issues, such as a timing attack against RSA decryption, a crash in NSS TLS method, failure to save return registers on Armv7-A, an integer overflow leading to out-of-bounds write, improper handling of out-of-memory conditions in ICU, CSP nonce leakage, clickjacking vulnerability, potential use-after-free, memory safety bugs, and privileged JavaScript execution via event handlers. These vulnerabilities could have severe consequences, including information disclosure, remote code execution, and unintended permission grants.
How To Fix
Minimum fixed version
115.9.1-1.el8_9.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by updating Firefox to the latest version.
Conclusion
Mozilla has released a critical security update for Firefox, addressing multiple vulnerabilities that could have severe consequences. It is highly recommended to update Firefox to version 115.9.1 ESR or later to mitigate these vulnerabilities and ensure the security of your browsing experience. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for firefox →
FAQ
The impact of these vulnerabilities can range from information disclosure to remote code execution and unintended permission grants. Attackers could exploit these vulnerabilities to compromise user data, execute malicious code, or gain unauthorized access to sensitive information.
You can check your Firefox version by navigating to the 'About Firefox' section in the browser's settings. If your version is prior to 115.9.1 ESR, it is affected by these vulnerabilities.
At the time of this advisory, there are no known exploits in the wild targeting these vulnerabilities. However, it is crucial to apply the recommended security update to protect against potential future exploits.
Continuing to use an older version of Firefox without updating exposes your system to the identified vulnerabilities. It is strongly advised to update to the latest version to ensure the security and integrity of your browsing experience.
You can find more information about these vulnerabilities, including their impact, CVSS scores, acknowledgments, and related details, on the respective CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
