Back

CVE-2024-9396

Oct. 1, 2024, 8:35 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Firefox

  • < 131

Firefox ESR

  • < 128.3

Thunderbird

  • < 128.3
  • < 131

Source

security@mozilla.org

Tags

CWE-119
security@mozilla.org
2024-10-01
CVE-2024-9396

CVE-2024-9396 details

Published : Oct. 1, 2024, 4:15 p.m.
Last Modified : Oct. 1, 2024, 8:35 p.m.

Description

It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVSS Score

1 2 3 4 5 6 7 8.8 9 10

Weakness

Weakness Name Description
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.8

Exploitability Score

2.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://bugzilla.mozilla.org/show_bug.cgi?id=1912471 security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-46/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-47/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-49/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-50/ security@mozilla.org
This website uses the NVD API, but is not approved or certified by it.