CVE-2024-4777

HIGH

Firefox < 126 and Firefox ESR < 115.11 - Use-After-Free

Title source: llm

Description

Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

References (6)

Core 6

Core References

Issue Tracking

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1878199%2C1893340

Mailing List

https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html

Mailing List

https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-21/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-22/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-23/

Scores

CVSS v3 8.8

EPSS 0.0066

EPSS Percentile 71.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-416 CWE-787

Status published

Products (4)

debian/debian_linux 10.0

mozilla/firefox < 115.11.0

mozilla/firefox < 126.0

mozilla/thunderbird < 115.11.0

Published May 14, 2024

Tracked Since Feb 18, 2026