Threats Tagged 'cve-2024-2609'

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.10.0 ESR. Security Fix(es): * GetBoundName in the JIT returned the wrong object (CVE-2024-3852) * Out-of-bounds-read after mis-optimized switch statement (CVE-2024-3854) * Incorrect JITting of arguments led to use-after-free during garbage collection (CVE-2024-3857) * Permission prompt input delay could expire when not in focus (CVE-2024-2609) * Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (CVE-2024-3859) * Potential use-after-free due to AlignedBuffer self-move (CVE-2024-3861) * Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 (CVE-2024-3864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities were addressed in Mozilla Firefox with the release of version 115.10.0 ESR. These include issues such as incorrect Just-In-Time (JIT) compilation leading to use-after-free and wrong object returns, out-of-bounds reads, integer overflow in the OpenType sanitizer, and permission prompt input delay expiration. The update fixes these memory safety and logic errors to improve browser security. The vulnerabilities affect Firefox ESR 115.10.0 and Firefox 125, as well as Thunderbird 115.10. The update is rated as important by Red Hat and is available for Red Hat Enterprise Linux 7 and related distributions.