kritik
CVE-2024-9680
firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (yüksek).
Açıklama
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | firefox, thunderbird | 128.3.1-2.el8_10.alma.1 ve 1 tane daha |
| alma 9 | firefox, firefox-x11, thunderbird | 128.4.0-1.el9_5 ve 1 tane daha |
| alpine 3.21 | mozjs | 128.3.1-r0 |
| alpine 3.22 | mozjs | 128.3.1-r0 |
| alpine 3.23 | mozjs | 128.3.1-r0 |
| alpine 3.24 | mozjs | 128.3.1-r0 |
| alpine edge | mozjs | 128.3.1-r0 |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 115.16.0-1.amzn2.0.1 |
| chainguard | firefox, firefox-esr | 131.0.2-r0 ve 1 tane daha |
| debian 11 | firefox-esr, thunderbird | 128.3.1esr-1~deb11u1 ve 1 tane daha |
| debian 12 | firefox-esr, thunderbird | 128.3.1esr-1~deb12u1 ve 1 tane daha |
| debian 13 | firefox-esr, thunderbird | 128.3.1esr-1 ve 1 tane daha |
29 kaynaktaki 49 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | firefox | 128.3.1-2.el8_10.alma.1 |
| alma 8 | thunderbird | 128.3.1-1.el8_10.alma.1 |
| alma 9 | firefox | 128.4.0-1.el9_5 |
| alma 9 | firefox-x11 | 128.4.0-1.el9_5 |
| alma 9 | thunderbird | 128.4.0-1.el9_5.alma.1 |
| alpine 3.21 | mozjs | 128.3.1-r0 |
| alpine 3.22 | mozjs | 128.3.1-r0 |
| alpine 3.23 | mozjs | 128.3.1-r0 |
| alpine 3.24 | mozjs | 128.3.1-r0 |
| alpine edge | mozjs | 128.3.1-r0 |
| amazon linux 2 | thunderbird | 115.16.0-1.amzn2.0.1 |
| amazon linux 2 | thunderbird-debuginfo | 115.16.0-1.amzn2.0.1 |
| chainguard | firefox | 131.0.2-r0 |
| chainguard | firefox-esr | 128.3.1-r0 |
| debian 11 | firefox-esr | 128.3.1esr-1~deb11u1 |
| debian 11 | thunderbird | 1:115.16.0esr-1~deb11u1 |
| debian 12 | firefox-esr | 128.3.1esr-1~deb12u1 |
| debian 12 | thunderbird | 1:115.16.0esr-1~deb12u1 |
| debian 13 | firefox-esr | 128.3.1esr-1 |
| debian 13 | thunderbird | 1:128.3.2esr-1 |
| debian 14 | firefox-esr | 128.3.1esr-1 |
| debian 14 | thunderbird | 1:128.3.2esr-1 |
| echo | firefox-esr | 128.3.1esr-1~deb12u1 |
| echo | thunderbird | 1:115.16.0esr-1~deb12u1 |
| Oracle Linux 7 | firefox | 128.3.1-2.0.1.el7_9 |
| Oracle Linux 8 | firefox | 128.3.1-2.0.1.el8_10 |
| Oracle Linux 8 | thunderbird | 128.3.1-1.0.1.el8_10 |
| Oracle Linux 9 | firefox | 128.4.0-1.0.1.el9_5 |
| Oracle Linux 9 | firefox-x11 | 128.4.0-1.0.1.el9_5 |
| Oracle Linux 9 | thunderbird | 128.4.0-1.0.1.el9_5 |
| rapidfort alpine 3.20 | thunderbird | 137.0-r0 |
| rapidfort alpine 3.21 | thunderbird | 137.0-r0 |
| rapidfort alpine 3.22 | thunderbird | 137.0-r0 |
| rapidfort alpine 3.23 | thunderbird | 137.0-r0 |
| rapidfort alpine 3.24 | thunderbird | 137.0-r0 |
| rapidfort Oracle Linux 9 | firefox | 0:128.4.0-1.0.1.el9_5 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:128.4.0-1.0.1.el9_5 |
| rapidfort Oracle Linux 9 | thunderbird | 0:128.4.0-1.0.1.el9_5 |
| Red Hat | firefox | düzeltme belirtilmemiş |
| Red Hat | thunderbird | düzeltme belirtilmemiş |
| rocky 8 | firefox | 128.3.1-2.el8_10 |
| rocky 8 | thunderbird | 128.3.1-1.el8_10 |
| rocky 9 | firefox | 128.3.1-2.el9_4 |
| rocky 9 | firefox-x11 | 128.3.1-2.el9_4 |
| rocky 9 | thunderbird | 128.3.1-1.el9_4 |
| ubuntu 20.04 | firefox | 131.0.2+build1-0ubuntu0.20.04.1 |
| ubuntu 20.04 | thunderbird | 1:115.16.0+build2-0ubuntu0.20.04.1 |
| ubuntu 22.04 | thunderbird | 1:115.16.0+build2-0ubuntu0.22.04.1 |
| wolfi | firefox | 131.0.2-r0 |
Referanslar
- https://access.redhat.com/errata/RHSA-2024:8025
- https://access.redhat.com/errata/RHSA-2024:9554
- https://access.redhat.com/security/cve/CVE-2024-9680
- https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992
- https://bugzilla.mozilla.org/show_bug.cgi?id=1923344
- https://bugzilla.redhat.com/2317442
- https://bugzilla.redhat.com/2322424
- https://bugzilla.redhat.com/2322425
36 referansın hepsi
- https://bugzilla.redhat.com/2322428
- https://bugzilla.redhat.com/2322429
- https://bugzilla.redhat.com/2322433
- https://bugzilla.redhat.com/2322434
- https://bugzilla.redhat.com/2322438
- https://bugzilla.redhat.com/2322439
- https://bugzilla.redhat.com/2322440
- https://bugzilla.redhat.com/2322444
- https://bugzilla.redhat.com/show_bug.cgi?id=2317442
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9680
- https://errata.almalinux.org/9/ALSA-2024-9554.html
- https://errata.rockylinux.org/RLSA-2024:8025
- https://linux.oracle.com/cve/CVE-2024-9680.html
- https://linux.oracle.com/errata/ELSA-2024-9554.html
- https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html
- https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039
- https://nvd.nist.gov/vuln/detail/CVE-2024-9680
- https://ubuntu.com/security/notices/USN-7065-1
- https://ubuntu.com/security/notices/USN-7066-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680
- https://www.cve.org/CVERecord?id=CVE-2024-9680
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-52/
- https://www.mozilla.org/security/advisories/mfsa2024-51/
- https://www.mozilla.org/security/advisories/mfsa2024-52/