Back

CVE-2024-9400

Oct. 1, 2024, 7:35 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Firefox

  • < 131

Firefox ESR

  • < 128.3

Thunderbird

  • < 128.3
  • < 131

Source

security@mozilla.org

Tags

CWE-119
security@mozilla.org
2024-10-01
CVE-2024-9400

CVE-2024-9400 details

Published : Oct. 1, 2024, 4:15 p.m.
Last Modified : Oct. 1, 2024, 7:35 p.m.

Description

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVSS Score

1 2 3 4 5 6 7 8.8 9 10

Weakness

Weakness Name Description
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.8

Exploitability Score

2.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://bugzilla.mozilla.org/show_bug.cgi?id=1915249 security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-46/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-47/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-49/ security@mozilla.org
https://www.mozilla.org/security/advisories/mfsa2024-50/ security@mozilla.org
This website uses the NVD API, but is not approved or certified by it.