critique
CVE-2024-8384
mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon AlmaLinux (élevée), Amazon (élevée), Oracle (élevée), Rocky Linux (élevée), Red Hat (moyenne), Ubuntu (moyenne).
Description
The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | firefox, thunderbird | 128.2.0-1.el8_10.alma.1 |
| alma 9 | firefox, firefox-x11, thunderbird | 128.2.0-1.el9_4.alma.1 |
| alpine 3.19 | mozjs115 | 115.15.0-r0 |
| alpine 3.20 | mozjs115 | 115.15.0-r0 |
| alpine 3.21 | mozjs | 115.15.0-r0 |
| alpine 3.22 | mozjs | 115.15.0-r0 |
| alpine 3.23 | mozjs | 115.15.0-r0 |
| alpine 3.24 | mozjs | 115.15.0-r0 |
| alpine edge | mozjs | 115.15.0-r0 |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 115.15.0-1.amzn2.0.1 |
| chainguard | firefox, firefox-esr | 130.0-r0 et 1 autres |
| debian 11 | firefox-esr, thunderbird | 115.15.0esr-1~deb11u1 et 1 autres |
Afficher les 46 entrées de 26 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | firefox | 128.2.0-1.el8_10.alma.1 |
| alma 8 | thunderbird | 128.2.0-1.el8_10.alma.1 |
| alma 9 | firefox | 128.2.0-1.el9_4.alma.1 |
| alma 9 | firefox-x11 | 128.2.0-1.el9_4.alma.1 |
| alma 9 | thunderbird | 128.2.0-1.el9_4.alma.1 |
| alpine 3.19 | mozjs115 | 115.15.0-r0 |
| alpine 3.20 | mozjs115 | 115.15.0-r0 |
| alpine 3.21 | mozjs | 115.15.0-r0 |
| alpine 3.22 | mozjs | 115.15.0-r0 |
| alpine 3.23 | mozjs | 115.15.0-r0 |
| alpine 3.24 | mozjs | 115.15.0-r0 |
| alpine edge | mozjs | 115.15.0-r0 |
| amazon linux 2 | thunderbird | 115.15.0-1.amzn2.0.1 |
| amazon linux 2 | thunderbird-debuginfo | 115.15.0-1.amzn2.0.1 |
| chainguard | firefox | 130.0-r0 |
| chainguard | firefox-esr | 128.2.0-r0 |
| debian 11 | firefox-esr | 115.15.0esr-1~deb11u1 |
| debian 11 | thunderbird | 1:115.15.0-1~deb11u1 |
| debian 12 | firefox-esr | 115.15.0esr-1~deb12u1 |
| debian 12 | thunderbird | 1:115.15.0-1~deb12u1 |
| debian 13 | firefox-esr | 115.15.0esr-1 |
| debian 13 | thunderbird | 1:128.2.0esr-1 |
| debian 14 | firefox-esr | 115.15.0esr-1 |
| debian 14 | thunderbird | 1:128.2.0esr-1 |
| echo | firefox-esr | 115.15.0esr-1~deb12u1 |
| echo | thunderbird | 1:115.15.0-1~deb12u1 |
| Oracle Linux 7 | firefox | 128.2.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 128.2.0-1.0.2.el8_10 |
| Oracle Linux 8 | thunderbird | 128.2.0-1.0.2.el8_10 |
| Oracle Linux 9 | firefox | 128.2.0-1.0.2.el9_4 |
| Oracle Linux 9 | firefox-x11 | 128.2.0-1.0.2.el9_4 |
| Oracle Linux 9 | thunderbird | 128.2.0-1.0.2.el9_4 |
| rapidfort Oracle Linux 9 | firefox | 0:128.2.0-1.0.2.el9_4 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:128.2.0-1.0.2.el9_4 |
| rapidfort Oracle Linux 9 | thunderbird | 0:128.2.0-1.0.2.el9_4 |
| Red Hat | firefox | pas de correctif indiqué |
| Red Hat | thunderbird | pas de correctif indiqué |
| rocky 8 | firefox | 128.2.0-1.el8_10 |
| rocky 8 | thunderbird | 128.2.0-1.el8_10 |
| rocky 9 | firefox | 128.2.0-1.el9_4.0.1 |
| rocky 9 | firefox-x11 | 128.2.0-1.el9_4.0.1 |
| rocky 9 | thunderbird | 128.2.0-1.el9_4.0.1 |
| ubuntu 20.04 | firefox | 130.0+build2-0ubuntu0.20.04.1 |
| ubuntu 20.04 | thunderbird | 1:115.15.0+build1-0ubuntu0.20.04.1 |
| ubuntu 22.04 | thunderbird | 1:115.15.0+build1-0ubuntu0.22.04.1 |
| wolfi | firefox | 130.0-r0 |
Références
- https://access.redhat.com/errata/RHSA-2024:6683
- https://access.redhat.com/security/cve/CVE-2024-8384
- https://bugzilla.mozilla.org/show_bug.cgi?id=1911288
- https://bugzilla.redhat.com/2309427
- https://bugzilla.redhat.com/2309428
- https://bugzilla.redhat.com/2309430
- https://bugzilla.redhat.com/2309431
- https://bugzilla.redhat.com/2309432
Les 46 références
- https://bugzilla.redhat.com/2309433
- https://bugzilla.redhat.com/2310481
- https://bugzilla.redhat.com/2310490
- https://bugzilla.redhat.com/show_bug.cgi?id=2307331
- https://bugzilla.redhat.com/show_bug.cgi?id=2309427
- https://bugzilla.redhat.com/show_bug.cgi?id=2309428
- https://bugzilla.redhat.com/show_bug.cgi?id=2309430
- https://bugzilla.redhat.com/show_bug.cgi?id=2309431
- https://bugzilla.redhat.com/show_bug.cgi?id=2309432
- https://bugzilla.redhat.com/show_bug.cgi?id=2309433
- https://bugzilla.redhat.com/show_bug.cgi?id=2310481
- https://bugzilla.redhat.com/show_bug.cgi?id=2310490
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7652
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8381
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8382
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8384
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8385
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8386
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8387
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8394
- https://errata.almalinux.org/9/ALSA-2024-6683.html
- https://errata.rockylinux.org/RLSA-2024:6683
- https://linux.oracle.com/cve/CVE-2024-8384.html
- https://linux.oracle.com/errata/ELSA-2024-6838.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-8384
- https://ubuntu.com/security/notices/USN-6992-1
- https://ubuntu.com/security/notices/USN-6995-1
- https://www.cve.org/CVERecord?id=CVE-2024-8384
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-39/#CVE-2024-8384
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-41/#CVE-2024-8384
- https://www.mozilla.org/security/advisories/mfsa2024-39/
- https://www.mozilla.org/security/advisories/mfsa2024-40/
- https://www.mozilla.org/security/advisories/mfsa2024-41/
- https://www.mozilla.org/security/advisories/mfsa2024-43/
- https://www.mozilla.org/security/advisories/mfsa2024-44/