Threats Tagged 'cve-2024-9680'

A use-after-free vulnerability (CVE-2024-9680) was identified in the Animation timeline component of Mozilla Firefox. This vulnerability affects Red Hat Enterprise Linux 8.2 versions of Firefox. Red Hat has issued a security advisory and released an update to address this issue. The vulnerability is rated as important by Red Hat Product Security. No CVSS score is provided in the advisory. The update is available for Red Hat Enterprise Linux 8.2 and should be applied to remediate the issue.

Multiple security vulnerabilities affecting Mozilla Thunderbird have been addressed in a Red Hat security update. These include denial of service via specially crafted WebTransport requests, memory safety bugs, potential directory upload bypass via clickjacking, external protocol handler enumeration, memory corruption issues, cross-origin access to PDF and JSON contents, and site isolation bypass by compromised content processes. The update applies to Thunderbird versions 128.3 and 131 as referenced in the advisory. Red Hat has released updated packages for Red Hat Enterprise Linux 8.8 Extended Update Support to remediate these issues.

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.