Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / CVE-2024-29944

critique

CVE-2024-29944

Mozilla: Privileged JavaScript Execution via Event Handlers

Publiée Modifiée CWE 830
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Le label propre à Trivy est CRITICAL. Critique selon Red Hat, AlmaLinux, Oracle, Rocky Linux. Plus basse selon Ubuntu (moyenne).

Description

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
alma 8firefox115.9.1-1.el8_9.alma.1
alma 9firefox, firefox-x11115.9.1-1.el9_3.alma.1
Oracle Linux 7firefox115.9.1-1.0.1.el7_9
Oracle Linux 8firefox115.9.1-1.0.1.el8_9
Oracle Linux 9firefox, firefox-x11115.9.1-1.0.1.el9_3
Red Hatfirefox, firefox-flatpak-containerpas de correctif indiqué
rocky 8firefox115.9.1-1.el8_9
alpine 3.18firefox-esr115.9.1-r0
alpine 3.19firefox-esr, mozjs115115.9.1-r0
alpine 3.20mozjs115115.9.1-r0
alpine 3.21mozjs115.9.1-r0
alpine 3.22mozjs115.9.1-r0
Afficher les 29 entrées de 24 sources
SourcePaquetCorrigé en
alma 8firefox115.9.1-1.el8_9.alma.1
alma 9firefox115.9.1-1.el9_3.alma.1
alma 9firefox-x11115.9.1-1.el9_3.alma.1
Oracle Linux 7firefox115.9.1-1.0.1.el7_9
Oracle Linux 8firefox115.9.1-1.0.1.el8_9
Oracle Linux 9firefox115.9.1-1.0.1.el9_3
Oracle Linux 9firefox-x11115.9.1-1.0.1.el9_3
Red Hatfirefoxpas de correctif indiqué
Red Hatfirefox-flatpak-containerpas de correctif indiqué
rocky 8firefox115.9.1-1.el8_9
alpine 3.18firefox-esr115.9.1-r0
alpine 3.19firefox-esr115.9.1-r0
alpine 3.19mozjs115115.9.1-r0
alpine 3.20mozjs115115.9.1-r0
alpine 3.21mozjs115.9.1-r0
alpine 3.22mozjs115.9.1-r0
alpine 3.23mozjs115.9.1-r0
alpine 3.24mozjs115.9.1-r0
alpine edgemozjs115.9.1-r0
chainguardfirefox-esr115.9.1-r0
debian 10firefox-esr115.9.1esr-1~deb10u1
debian 11firefox-esr115.9.1esr-1~deb11u1
debian 12firefox-esr115.9.1esr-1~deb12u1
debian 13firefox-esr115.9.1esr-1
debian 14firefox-esr115.9.1esr-1
echofirefox-esr115.9.1esr-1~deb12u1
rapidfort Oracle Linux 9firefox0:115.9.1-1.0.1.el9_3
rapidfort Oracle Linux 9firefox-x110:115.9.1-1.0.1.el9_3
ubuntu 20.04firefox124.0.1+build1-0ubuntu0.20.04.1

Références

Les 45 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.