CVE-2024-6609

HIGH

Firefox < 128 and Thunderbird < 128 - Use-After-Free in Elliptic Curve Key Handling

Title source: llm

Description

When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.

References (4)

Core 4

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2024/10/msg00028.html

Issue Tracking, Permissions Required

https://bugzilla.mozilla.org/show_bug.cgi?id=1839258

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-29/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-32/

Scores

CVSS v3 8.8

EPSS 0.0057

EPSS Percentile 68.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (2)

mozilla/firefox < 128.0

mozilla/thunderbird < 128.0

Published Jul 09, 2024

Tracked Since Feb 18, 2026