Moderate: Firefox Security Update - Arbitrary JavaScript Execution, IndexedDB Files Retained, Permissions Request Bypass, and More
Summary
ALSA-2024:3783: Moderate: firefox security update. Affects firefox versions < 115.11.0-1.el8_10.alma.1. Fixed in 115.11.0-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is an open-source web browser known for its compliance with web standards, performance, and portability. It is widely used by individuals and organizations for browsing the internet. However, a recent security update has been released to address several vulnerabilities in Firefox.
Vulnerability Detail
The security update addresses multiple vulnerabilities in Firefox:
-
Arbitrary JavaScript execution in PDF.js (CVE-2024-4367): This vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the PDF.js library.
-
IndexedDB files retained in private browsing mode (CVE-2024-4767): In private browsing mode, IndexedDB files were not properly cleared, potentially allowing an attacker to access sensitive information.
-
Potential permissions request bypass via clickjacking (CVE-2024-4768): This vulnerability could allow an attacker to trick users into granting permissions by overlaying a malicious element on top of a legitimate permissions prompt.
-
Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769): This vulnerability could allow an attacker to differentiate between script and non-script content-types, potentially leading to security bypasses.
-
Use-after-free could occur when printing to PDF (CVE-2024-4770): This vulnerability could allow an attacker to exploit a use-after-free bug when printing to PDF, potentially leading to arbitrary code execution.
-
Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777): Multiple memory safety bugs were fixed in the latest versions of Firefox and Thunderbird, addressing potential security vulnerabilities.
How To Fix
Minimum fixed version
115.11.0-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Mozilla Firefox has released a security update to address multiple vulnerabilities. It is crucial for users to update their browsers to the latest version to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for firefox →
FAQ
Mozilla Firefox is an open-source web browser known for its compliance with web standards, performance, and portability. It is widely used for browsing the internet.
The security update addresses multiple vulnerabilities, including arbitrary JavaScript execution, retention of IndexedDB files in private browsing mode, potential permissions request bypass, distinguishing between script and non-script content-types, use-after-free when printing to PDF, and memory safety bugs.
These vulnerabilities could allow an attacker to execute arbitrary JavaScript code, access sensitive information, bypass permissions requests, differentiate between content-types, execute arbitrary code, and exploit memory safety bugs. This could lead to unauthorized access, data leakage, and potential remote code execution.
To fix the vulnerabilities, it is recommended to update Mozilla Firefox to version 115.11.0 ESR. This update includes the necessary patches to address the identified security issues.
Users can download the latest version of Mozilla Firefox from the official Mozilla website (https://www.mozilla.org) or use their operating system's package manager to update the browser.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
