Red Hat Security Advisory: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461) * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458) * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459) * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467) * firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465) * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466) * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463) * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462) * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
Red Hat Product Security issued an advisory (RHSA-2024:8720) for Mozilla Firefox and Thunderbird addressing ten security vulnerabilities (CVE-2024-10458 through CVE-2024-10467). The flaws include a permission leak via embed or object elements (CVE-2024-10458), use-after-free in layout with accessibility (CVE-2024-10459), XSS due to ignored Content-Disposition headers (CVE-2024-10461), denial of service via history interface (CVE-2024-10464), and memory safety bugs fixed in Firefox 132 and Thunderbird 132. The update also resolves issues such as clipboard paste button persistence across tabs, DOM push subscription message hangs, cross-origin video frame leaks, and spoofing of permission prompt origins. These vulnerabilities impact Firefox and Thunderbird packages distributed with Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The advisory provides updated packages to remediate these issues.
Potential Impact
The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in the browser. These issues may affect browser security and user privacy. The advisory rates the security impact as moderate. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.2 Extended Update Support and related variants that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2024:8720. For update instructions, refer to https://access.redhat.com/articles/11258. Since official fixes are available, applying these updates is the recommended remediation.
Red Hat Security Advisory: firefox security update
Description
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461) * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458) * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459) * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467) * firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465) * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466) * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463) * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462) * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security issued an advisory (RHSA-2024:8720) for Mozilla Firefox and Thunderbird addressing ten security vulnerabilities (CVE-2024-10458 through CVE-2024-10467). The flaws include a permission leak via embed or object elements (CVE-2024-10458), use-after-free in layout with accessibility (CVE-2024-10459), XSS due to ignored Content-Disposition headers (CVE-2024-10461), denial of service via history interface (CVE-2024-10464), and memory safety bugs fixed in Firefox 132 and Thunderbird 132. The update also resolves issues such as clipboard paste button persistence across tabs, DOM push subscription message hangs, cross-origin video frame leaks, and spoofing of permission prompt origins. These vulnerabilities impact Firefox and Thunderbird packages distributed with Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. The advisory provides updated packages to remediate these issues.
Potential Impact
The vulnerabilities collectively could lead to denial of service conditions, cross-site scripting attacks, permission leaks, use-after-free memory corruption, memory safety issues, UI spoofing, and potential hangs in the browser. These issues may affect browser security and user privacy. The advisory rates the security impact as moderate. There are no known exploits in the wild at the time of the advisory.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.2 Extended Update Support and related variants that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2024:8720. For update instructions, refer to https://access.redhat.com/articles/11258. Since official fixes are available, applying these updates is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:8720
- Cve Count
- 10
- Additional Cves
- ["CVE-2024-10459","CVE-2024-10460","CVE-2024-10461","CVE-2024-10462","CVE-2024-10463","CVE-2024-10464","CVE-2024-10465","CVE-2024-10466","CVE-2024-10467"]
Threat ID: 6a3e805acef61ccff970055e
Added to database: 06/26/2026, 13:36:26 UTC
Last enriched: 06/26/2026, 13:40:18 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.