Back

CVE-2024-7652

Sept. 6, 2024, 9:35 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Firefox

  • < 128
  • ESR < 115.13

Thunderbird

  • < 115.13
  • < 128

Source

security@mozilla.org

Tags

CWE-476
security@mozilla.org
2024-09-06
CVE-2024-7652

CVE-2024-7652 details

Published : Sept. 6, 2024, 7:15 p.m.
Last Modified : Sept. 6, 2024, 9:35 p.m.

Description

An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

CVSS Score

1 2 3 4 5 6 7.5 8 9 10

Weakness

Weakness Name Description
CWE-476 NULL Pointer Dereference A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

7.5

Exploitability Score

3.9

Impact Score

3.6

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL Source
https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 security@mozilla.org
https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-29/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-30/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-31/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-32/ security@mozilla.org
This website uses the NVD API, but is not approved or certified by it.