CVE-2024-0743

HIGH

Firefox < 122.0 - Denial of Service via TLS Handshake Return Value

Title source: llm

Description

An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9.

References (8)

Core 8

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2024/03/msg00010.html

Mailing List

https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html

Mailing List

https://lists.debian.org/debian-lts-announce/2024/10/msg00028.html

Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1867408

Release Notes, Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-01/

Mailing List

https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-13/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-14/

Scores

CVSS v3 7.5

EPSS 0.0130

EPSS Percentile 66.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-252

Status published

Products (1)

mozilla/firefox < 122.0

Published Jan 23, 2024

Tracked Since Feb 18, 2026