crítica
CVE-2024-29944
Mozilla: Privileged JavaScript Execution via Event Handlers
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat, AlmaLinux, Oracle, Rocky Linux. Más baja según Ubuntu (media).
Descripción
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox | 115.9.1-1.el8_9.alma.1 |
| alma 9 | firefox, firefox-x11 | 115.9.1-1.el9_3.alma.1 |
| Oracle Linux 7 | firefox | 115.9.1-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 115.9.1-1.0.1.el8_9 |
| Oracle Linux 9 | firefox, firefox-x11 | 115.9.1-1.0.1.el9_3 |
| Red Hat | firefox, firefox-flatpak-container | sin corrección indicada |
| rocky 8 | firefox | 115.9.1-1.el8_9 |
| alpine 3.18 | firefox-esr | 115.9.1-r0 |
| alpine 3.19 | firefox-esr, mozjs115 | 115.9.1-r0 |
| alpine 3.20 | mozjs115 | 115.9.1-r0 |
| alpine 3.21 | mozjs | 115.9.1-r0 |
| alpine 3.22 | mozjs | 115.9.1-r0 |
Mostrar las 29 entradas de 24 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox | 115.9.1-1.el8_9.alma.1 |
| alma 9 | firefox | 115.9.1-1.el9_3.alma.1 |
| alma 9 | firefox-x11 | 115.9.1-1.el9_3.alma.1 |
| Oracle Linux 7 | firefox | 115.9.1-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 115.9.1-1.0.1.el8_9 |
| Oracle Linux 9 | firefox | 115.9.1-1.0.1.el9_3 |
| Oracle Linux 9 | firefox-x11 | 115.9.1-1.0.1.el9_3 |
| Red Hat | firefox | sin corrección indicada |
| Red Hat | firefox-flatpak-container | sin corrección indicada |
| rocky 8 | firefox | 115.9.1-1.el8_9 |
| alpine 3.18 | firefox-esr | 115.9.1-r0 |
| alpine 3.19 | firefox-esr | 115.9.1-r0 |
| alpine 3.19 | mozjs115 | 115.9.1-r0 |
| alpine 3.20 | mozjs115 | 115.9.1-r0 |
| alpine 3.21 | mozjs | 115.9.1-r0 |
| alpine 3.22 | mozjs | 115.9.1-r0 |
| alpine 3.23 | mozjs | 115.9.1-r0 |
| alpine 3.24 | mozjs | 115.9.1-r0 |
| alpine edge | mozjs | 115.9.1-r0 |
| chainguard | firefox-esr | 115.9.1-r0 |
| debian 10 | firefox-esr | 115.9.1esr-1~deb10u1 |
| debian 11 | firefox-esr | 115.9.1esr-1~deb11u1 |
| debian 12 | firefox-esr | 115.9.1esr-1~deb12u1 |
| debian 13 | firefox-esr | 115.9.1esr-1 |
| debian 14 | firefox-esr | 115.9.1esr-1 |
| echo | firefox-esr | 115.9.1esr-1~deb12u1 |
| rapidfort Oracle Linux 9 | firefox | 0:115.9.1-1.0.1.el9_3 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:115.9.1-1.0.1.el9_3 |
| ubuntu 20.04 | firefox | 124.0.1+build1-0ubuntu0.20.04.1 |
Referencias
- http://www.openwall.com/lists/oss-security/2024/03/23/1
- https://access.redhat.com/errata/RHSA-2024:1485
- https://access.redhat.com/security/cve/CVE-2024-29944
- https://bugzilla.mozilla.org/show_bug.cgi?id=1886852
- https://bugzilla.redhat.com/2243644
- https://bugzilla.redhat.com/2260012
- https://bugzilla.redhat.com/2270660
- https://bugzilla.redhat.com/2270661
Las 45 referencias
- https://bugzilla.redhat.com/2270662
- https://bugzilla.redhat.com/2270663
- https://bugzilla.redhat.com/2270664
- https://bugzilla.redhat.com/2270665
- https://bugzilla.redhat.com/2270666
- https://bugzilla.redhat.com/2271064
- https://bugzilla.redhat.com/show_bug.cgi?id=2243644
- https://bugzilla.redhat.com/show_bug.cgi?id=2260012
- https://bugzilla.redhat.com/show_bug.cgi?id=2270660
- https://bugzilla.redhat.com/show_bug.cgi?id=2270661
- https://bugzilla.redhat.com/show_bug.cgi?id=2270662
- https://bugzilla.redhat.com/show_bug.cgi?id=2270663
- https://bugzilla.redhat.com/show_bug.cgi?id=2270664
- https://bugzilla.redhat.com/show_bug.cgi?id=2270665
- https://bugzilla.redhat.com/show_bug.cgi?id=2270666
- https://bugzilla.redhat.com/show_bug.cgi?id=2271064
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5388
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0743
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2607
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2608
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2610
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2611
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2612
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2614
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2616
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29944
- https://errata.almalinux.org/9/ALSA-2024-1485.html
- https://errata.rockylinux.org/RLSA-2024:1484
- https://linux.oracle.com/cve/CVE-2024-29944.html
- https://linux.oracle.com/errata/ELSA-2024-1486.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-29944
- https://ubuntu.com/security/notices/USN-6710-1
- https://www.cve.org/CVERecord?id=CVE-2024-29944
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-16/#CVE-2024-29944
- https://www.mozilla.org/security/advisories/mfsa2024-15/
- https://www.mozilla.org/security/advisories/mfsa2024-16/