Important: Firefox Security Update (ALSA-2024:4517)
Summary
ALSA-2024:4517: Important: firefox security update. Affects firefox versions < 115.13.0-3.el8_10.alma.1. Fixed in 115.13.0-3.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is an open-source web browser known for its adherence to standards, performance, and portability. It is widely used by individuals and organizations for browsing the internet. The vulnerability discussed in this report affects the Firefox package in AlmaLinux 8.
Vulnerability Detail
The vulnerability (CVE-2024-6604) addressed in this security update is related to memory safety bugs in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13. These bugs could potentially lead to memory corruption and compromise the security and stability of the affected applications. Additionally, there is a race condition in permission assignment (CVE-2024-6601) and a memory corruption issue in thread creation (CVE-2024-6603) that have been fixed.
How To Fix
Minimum fixed version
115.13.0-3.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this security update addresses critical vulnerabilities in the Firefox package. It is highly recommended to update to the fixed version to ensure the security and stability of your system. Regularly applying security updates is essential to protect against potential threats.
See every vulnerability recorded for firefox →
FAQ
These vulnerabilities could potentially allow attackers to execute arbitrary code, cause denial-of-service conditions, or gain unauthorized access to sensitive information.
No, only Firefox versions 128, Firefox ESR 115.13, and Thunderbird 115.13 are affected by the memory safety bugs. However, the race condition and memory corruption issues affect all versions.
At the time of this report, there are no known exploits for these vulnerabilities. However, it is crucial to apply the security update as soon as possible to mitigate any potential risks.
Yes, these vulnerabilities can be exploited remotely. Attackers can target vulnerable systems over the internet without requiring physical access.
No specific workaround has been provided for these vulnerabilities. It is recommended to update the Firefox package to the fixed version mentioned earlier.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
