CVE-2024-9401

CRITICAL

Firefox < 131 and ESR < 128.3 and ESR < 115.16 - Memory Corruption

Title source: llm

Description

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

References (7)

Core 7

Core References

Issue Tracking

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-46/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-47/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-48/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-49/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2024-50/

Mailing List

https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html

Scores

CVSS v3 9.8

EPSS 0.0017

EPSS Percentile 37.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-119

Status published

Products (3)

mozilla/firefox < 115.16.0

mozilla/firefox < 131.0

mozilla/thunderbird < 128.3.0

Published Oct 01, 2024

Tracked Since Feb 18, 2026